Using other information they have acquired they would phone the bank’s customer service line, convince them that they were you & gain control of the account. How hard this is depends on the bank. The fact that you have a strong password & two factor authentication is irrelevant.

I guess it's plausible that they could phone my bank and convince them they were me, even though the bank asks several control questions like "what was the amount on your recent bill to Company X?". But assume they've gotten past that, how do they then "gain control of my account"? If they ask for a new 2fa chip or a new debit card, that gets sent to my address by registered letter, so I have to go to the local post office and present photo ID to get it. I don't have any other ways of accessing my account than by internet bank or debit card.

You should not assume an attacker would walk in through the front door like you do. There are more components in the stack, all of which could be a worthy target.