I believe Scotia/Tangerine are still 6-digits only for passwords. Really. And I have yet to see any Canadian financial institution (whether bank, brokerage, credit union, etc) that supports anything else than SMS for 2FA.
The situation is quite rough indeed.