They're otherwise not terrible, and the limited banking I do works fine on the phone, so it didn’t bother me too much.
I would have taken the opportunity to "educate" them that that your use case is a legitimate one, and why they should teach their systems not to block users like that.
Because mapping a very understandable security concern from the computer security department to the human concept of respect is nonsense.
Opportunity costs of changing stuff, lack of alternatives, and if there are, they are probably doing the same shit anyways...