My bank's (Lloyds TSB) idea of extra security beyond a password is ... yet another password, but one that you have to select 3 random digits of, in dropdown box

My bank's (Lloyds TSB) idea of extra security beyond a password is ... yet another password, but one that you have to select 3 random digits of, in dropdown boxes. I asked them for TOTP 2FA, but never got a response... Why is it always banks who have some of the worst security posture out there? I fully expect my bank to eventually implement 2FA ... by SMS! Thinking that it's a good idea! sigh