Just run through the scenario you have in mind: would the attacker not be able to easily automate the forwarding of the OTP? Would grandmas still be able to use

Just run through the scenario you have in mind: would the attacker not be able to easily automate the forwarding of the OTP? Would grandmas still be able to use online banking? It's a trade-off, and validity periods so short that the user has to race a potential attacker, I don't think that's viable.