Don't worry, more and more banks are going to apps where they "outsource" all security to Apple and Google on their respective phone OS security implementation. At least on android, the apps will detect if accessibility functions (and developer's options) are turned on and will refuse to run the app. Who even needs accessibility right? Like there's no less able bodied people using smartphones. And what's that? It's your phone? No, silly customer, we banks must protect you from getting scammed by policing your device. It's the bank's property. You bought that phone on financing anyways, so it really isn't your property.

I am definitely not angry at this outcome. I bought my phone fair and square

actually they can't use TOTP because the second verification need to display the amount of the transaction and as I know it is impossible to do with TOTP.