I think they pretty much all do since integrating a real 2fa app would have to go through ten different approval processes and then also get approved by their federal insurance and stuff. Banks are some of the most inefficiently run institutions around.