Magisk (Android root utility) has the ability to hide itself very well. Google Pay and most, if not all, banking apps are not able to detect it. It is a cat and mouse game for sure, but so far the Magisk developers are keeping ahead of that curve.

Wasn't the most active development on Magisk from when Pokemon Go was really big? I remember there being an arms race with Niantic at some point.

If I’m not mistaken, it is common for windows malware to act differently if it is running inside a VM, to avoid analysis.

Yeah, then you'd be <a href=https://www.urbandictionary.com/define.php?term=munsoned>mun...