This is not universally a problem. In switzerland you receive a letter with a qr code, which with your username/password can activate a app which does a 2nd factor authentication, but it also requres to scan an qr code from thd web every time you login.

Setting it up is a pain, also it‘s impossible to transfer to another device without the original barcode.

But it seems pretty convinient for me an very secure. Login with account-id and password, scan a qr-code with the app and verify the login in it.

Still phone communication is very insecure…