Yeah, where I'm from (Belgium) 2fa is the industry standard by now, and fraud cases were reduced immensely when a previous employer of mine made the switch several years ago. But like you mentioned, this is not just up to devs in most cases...
They used to use a password, but that risks people putting their bank password into some dodgy shopping site.
VISA's implementation: https://www.visaeurope.com/making-payments/verified-by-visa/