You are correct, I can also use the code card of one-use keys.
I was confused by the recent change where online purchases require an SMS or the app, and no longer work with the code card.
I think the app is probably encouraged since it protects against a phishing site like this: hxxp://tilbagebetaling1060dkk.net/1060DKK/ -- but I'm not quite sure how.
Personally I really hate that they want to kill the card, and go to an app model (with the option of a key fob). It's made even worse by the police (and others) pushing the idea that the app is safer. How is it safer to have your two-factor authentication app on the same devices as the apps that need the second factor? Those things should be separate.