More advanced tokens also do more. My bank uses a hardware token for signing transfers and other actions which can include a human readable message or part of the target account number, making MITM much harder.

A definition issue with regard to "token": I sincerely do not think a device with display and keyboard used to sign transactions can be called "token". I'd say something like: trusted signing processor. But then again, I'm not a security specialist.

1. The bank should require a confirmation with your token to send money. If you don't send anything, the attacker can't either.

2. In the future, after the logout timeout, you know the attacker can't even read your account.

It greatly reduces the attack surface you need to worry about. Any attack they do must be right then.