Any system can be compromised if not used carefully. As others have said, if the phone is rooted and apps are installed that do contain exploits then a risk exists for information to be captured from the various interfaces on the device because the device itself can no longer be "trusted."
Some apps can contain malware and viruses such as the free flashlight apps that were stealing passwords. Also if an app like DroidStealth can hide itself, other apps can as well.
That being said there are underlying issues with several of the encryption schemes being deployed for things like OpenSSL. It really comes down to how the applications for your bank are written, who wrote them, and how locked down your device is.
Other risk factors depend on the network. Just as a phone can be compromised a cell tower or wifi access point can both be compromised to allow someone to inject their own certificates and decrypt the information in-between. Since you're using an app, depending on the level of checking the app does for a particular certificate, it could be possible that it may believe it is connecting to the bank's server when it is really connecting to something else.
While there is a layer of "security" in regard to the mobile devices and what they allow and don't allow, there is also a layer of risk because the end user has no way of knowing what level the end certificates are without packet sifting (more complex over cellular). Read up on all of the latest exploits for the apps you use and adjust accordingly.
Other thoughts
If you look at it from the bank's standpoint, if it's a big bank, they likely have a team of developers working on the app all the time. It's a PR nightmare if they have an app that allows people to steal money from the bank. They'll likely roll-out updates monthly, if not weekly. They'll tell you what's been fixed. That being said, they can't control your device or your OS. Read the end user license agreement for the software you downloaded from your bank. In it, they'll clearly state what they are and are not responsible for. If they're not responsible for something according to that document, then there is the possibility that they may not plan for it in their coding, simply because they're not legally liable. While it may be in their best interest from a social standpoint, in some circumstances banks have been allowed to shift their risk in terms of their responsibility in regard to online risks. Banks get funding from governments and are protected by those different governments in certain events so it depends on your region. Because of that they are also required by law to have a reasonable level of security for whatever they produce and give out to their customers within certain jurisdictions.
In many cases the end user can be protected if they don't use the apps, because if a transaction happens via the app, even though it's not the bank customer's doing, the bank has no way of verifying the transaction is fraudulent if the person's account is authenticated on their mobile device. Meaning to the bank if it looks like you because they have all of the credentials and your account is authenticated from your device, then it likely is you, therefore anything "you" do you are liable for, whether the "you" is really you. If it comes down to a suit, they win because they have more money.
If you're using a desktop computer it might be easier to prove that you really didn't transfer all of your money away because there are logs. You can also limit access to the machine, and even setup a designated machine for sensitive transactions. Additionally on a desktop machine you can install software that will help to protect your system from viruses and malware. Be sure to update any device or machine to the most recent up-to-date versions as security releases happen quite frequently these days.
In any case you might want to look into installing software on your device that looks for exploits such as rootkits, malware, and viruses. While this isn't a fix for poor programming, bad habits, or improper usage, it could mitigate risk. You might also want to look into getting a more secure device if this is a personal issue.