Don’t tie banks have extra steps to do things beyond read-only authentication?

My bank requires 2FA to send money to new payees. While losing my user/pass would lead to information leak, there’s little chance of my money being shipped off without further breeches.