That has some nice attributes though. Five digits should be quite easy to memorize, avoiding written down passwords. Most phone PINS are four digits, so you avoid phone PIN reuse. Realistically, the second factor is providing the bulk of the security. If that's a typical six digit TOTP, and they validate the PIN and TOTP together then an attacker has a one in one hundred billion chance of guessing correctly (10^5 + 10^6). Add in rate limiting by account and IP address, account locking, and other tools and that's extremely secure.

You COULD have a longer password, but the extra entropy is probably excessive. It probably increases the chance of password reuse problems, so pragmatically it may be worse.

I wouldn't recommend this approach in general, however.

USAA?

If not, do they also do the weird Symantic codes that're literally vanilla TOTP under the hood[0] but wants you to be locked in to a proprietary app instead?

[0] https://locima.com/2019/06/01/replacing-symantec-vip-with-a-...