Not Australia here but I use Native Alpha to create a webapp version of things that I dont want the invasive apps of but that have good browser options, like my bank.

What bank asks for those permissions? Just so I know to avoid them.

I have ANZ here in NZ and can use them in AU as well. The only permission I allow them is notifications.

I prefer browser(web)-based banking apps which work well on a phone UI without the info-access creep.

UBank (NAB subsidary) and Wise (not a bank) both support passkeys for login in the browser. Most other banks here seem to have regressed from hardware tokens to SMS codes or proprietary apps for their MFA.

Passkeys are only as secure as your passkeys -- I use Bitwarden with master password re-prompt checked for bank credentials, but I should probably switch to a hardware based passkey (at least for unlocking Bitwarden itself).

The phone apps are sometimes required to do some things (like managing passkeys for UBank, verifying ID in Wise). They work on LineageOS without the google stuff, but might be worth installing only temporarily in a separate profile or phone.

Retail payments -- just use a physical card if you're not using cash.

I'm using boq and up, for ethical reasons, but I haven't looked into their privacy or compatibility.

For westpac I just login on a browser on my phone, so no app downloaded

ING works fine with no permissions.