In Poland most banks I use (Citibank, Santander, Millenium and others) require confirming logging into account via SMS at least once in two weeks. Some require confirmation via mobile app. (That wasn't obligatory before)

Its rather that banks have phased out other methods like tokens as too expensive and troublesome.

https://www.money.pl/banki/santander-pko-bp-mbank-czy-pekao-...

https://www.spidersweb.pl/2019/09/jak-zalogowac-sie-do-banku...

Even according to these articles, most support an app-based solution that doesn't require a phone number?

This isn't so. Yes you can use banking app but this might be even worse for privacy. It depends a lot on implementation details of the app. For example Santander app won't even start without permission to manage you phone on Android.