Because they are hellaciously expensive, in terms of:

* cost to retrofit the backend of these systems onto the bank's retail software

* cost to roll out tokens to customers

* ongoing support costs for e.g. lost or broken tokens

To all that, you have to layer on the fact that tokens are priced for a different market (enterprise security), so the existing products aren't packaged in a way that makes them palatable to (say) Bank of America's many tens of millions of customers. You can't wave a magic wand on that problem either; tokens are packaged the way they are now because that's how you can keep a token company in the black.