sadly it seems like most of the banks I use still enforce antiquated password rules, no MFA and rely on stupid questions most of which can easily be guessed from public records.
This changes by banks, some send code to our phone number (thought WhatsApp or SMS), others send SMS+email + face ID. All of them require at least the face ID. Some biggest banks requires you to go to ATM to authorize app access. You insert your card, password and authorize there.
There's Mercado Pago, which supports passkeys and standard MFA too. So you can store on bitwarden even.
Just absurd.
Nobody hacks because that's illegal