Just curious: Doesn't you Danish account still support the little cardboard card with the one-time codes?

Personally I really hate that they want to kill the card, and go to an app model (with the option of a key fob). It's made even worse by the police (and others) pushing the idea that the app is safer. How is it safer to have your two-factor authentication app on the same devices as the apps that need the second factor? Those things should be separate.

You are correct, I can also use the code card of one-use keys.

I was confused by the recent change where online purchases require an SMS or the app, and no longer work with the code card.

I think the app is probably encouraged since it protects against a phishing site like this: hxxp://tilbagebetaling1060dkk.net/1060DKK/ -- but I'm not quite sure how.

SMS as a 2nd factor is ( for a very good reason ) prohibited by dspp2 European directive. You.might have escaped that with brexit though. Even old school banks ( French dude here ) are forced to use apps as 2fa, but my bank for example can provide an hardware token, or a smartcard.