How is a PC "more vulnerable" than a phone?
A PC is not necessarily more vulnerable than a phone in theory. In practice it is much more vulnerable.
On a phone you are conditioned to a banking app. The odds of you getting a malicious or fake banking app for your bank is pretty close to zero. The app delivery system is far from perfect, but its not full of fake malicious banking apps for my bank.
On a desktop you are conditioned to use a banking website. Being on a fake website for your bank is just one convincing phishing email away or one malicious google result away for a very large number of people.
The mobile app also has a phone number etc, and is generally more traceable, so its possible to incorporate additional checks into the banking app to verify that the account is being accessed from the mobile associated with the account. Similar checks on a PC are possible, but setting them up is more complex, and "device enrolment" tends to be weaker.
Is a phone (which certainly CAN be secured to high levels but in my experience rarely is) inherently more secure than an atm card and pin that only the user knows?
You stick a card into a device you have no control over (and its not a smart or secure card it's just got a mag stripe with some machine readable information on it, easily skimmed and cloned), and then punch your PIN into a keypad somebody else owns in a world full of cameras, and you trust neither the cameras nor the keypad is recording it?
Phone payment systems are incomparably more secure. They can generate one-time use card numbers for transactions for specific amounts, and can have authorization on the phone side of the transaction (ie send a text to confirm a transaction or notification through the banking app) for the user to confirm it. If you skim the code you have nothing. If you record the user unlocking their phone, you have nothing unless you steal their phone. This is worlds more secure than an ATM card.