I don't know the bank they are referring to, but I can cite an example for me: RBC Royal Bank of Canada requires the mobile app. There is nothing you can do on their website without first 2FA via their specific mobile app, and even then only in limited transaction sizes. If you want "full access" (e.g. up to $10k daily transfer via e-transfer) then you MUST use biometrics and the mobile app.