I honestly find 2fa enforcement detremential and it should be entirely possible to opt out - case in point my current bank (not by choice, ridiculous country that can't manage to join the euro) are disabling SMS 2fa for online banking and suggest using their app, except the app doesn't work (they'll still send 3ds via SMS though!!) and they've basically stopped bothering to reply - anyway the point really is that people who are not morons should be able to opt out, because the onus and damage on the end user often outweighs any possible risk of stealing funds etc (there's literally nothing in the account, standing order sends all of my income to a useful bank abroad the day after it arrives).

As an aside, open banking is also a joke as it doesn't allow the end user access to their own account, only 3rd parties - simple API access would make this problem moot, as where I hold my funds grants me API access and I can do things like trigger transfers on webhooks etc, very simple and infinitely useful.

I bank with a local credit union, and their online banking originally only supported SMS. I wrote to them about the many security issues with that, and an executive responded and acknowledged my concerns.

A few months later they added TOTP support. Not sure if I influenced that at all, but it's just another reason why I will only ever use a credit union as my main bank.

As per your last comment, I would likely be changing banks in that scenario, and letting them know exactly why they are losing a customer. Even if it doesn't seem like any one individual making sure that reason is documented, I do think in aggregate eventually it could be enough to make a difference with stuff like this.