Banks still use text messages for two factor, not even an authentication app. And it’s been proven multiple times that stealing numbers is way easier than it should be. I don’t expect banks to migrate to WebAuthn any time soon.