I’d say that POST benchmark is a bit disingenuous given it is also testing Ecto. But for the GET I would suggest enabling the supercarrier to 85% of the available memory, that could give Bandit a boost. I’ve been profiling some webservers using msacc recently and quite a bit of time is spent in GC. I wonder if it is a similar scenario in this case.
Futher, the benchmark application uses Jason.encode instead of Jason.encode_to_iodata While the body is not large, I’m sure it would help. Using :erlang.byte_size on the encoded device lists shows that they breach the refc binary threshold. This has the potential to put pressure on the binary allocator and effect the system negatively. Keeping these terms to the local process heap might be a benefit.
Final note is that iirc these are the “defacto” configs to use Any tips on tuning the BEAM VM? - #2 by scottmessinger. These are not set in the vmargs of the test app.
+sbwt none
+sbwtdcpu none
+sbwtdio none
TL;DR VM settings could make Bandit look better 
