I'm pretty sure all UK banks use multi factor now (mostly card readers and mobile apps), but they certainly weren't like that from their inception. I didn't encounter multi factor for at least five years after my first web-based account. They were all terrible combinations of passwords, secret questions and entering three characters from another password. I remember being fascinated by the multi factor token that my Swedish friends had in th the early 2000s. The last UK account that I had without any form of multi factor auth was probably about five years ago.

Bank transfers have always been free. Previously these were called BACS, and took three days. Now they're "faster payments" and are effectively instant. Bills are paid by Direct Debit, which is a pull system, which sounds scary but generally works well.