There is rather a lack of regulations that would require banks to provide two-factor authentication in a platform-neutral or technology-neutral manner. Instead

There is rather a lack of regulations that would require banks to provide two-factor authentication in a platform-neutral or technology-neutral manner. Instead of two-factor-only apps, we get "electronic ID" that are legally like a photo ID, and which are also used for making payments from the phone itself. In fact, some of these rely on security of the OS it is running on, and not on the use of any trusted platform modules ("secure enclave", TrustZone, etc.) or on any mathematical proof. Therefore, un-rooted recent versions of Android and iOS is compulsory in practice, because those are the only environments that are secure enough. And BTW, the electronic ID are very convenient for the banks. If they get social-engineered and the banks' API abused, the banks can conveniently blame the victims — because it's a legal ID and not merely a login helper or debit card, and you're not supposed to be "careless" with an ID.