When I sign on to a bank it sends an SMS. Then my phone prompts me to share that code with the brower, on my desktop. It's a neat QOL "feature" - but kinda feels too automated to be secure.

That's because the server recognizes both clients, and you are prompted to approve the other client from the client that has the code. You are giving permission to the remote client, not taking permission from the remote client.

The server recognized my device from the messenger/SMS app? That seems not correct.

But somehow, the desktop browser and my mobile are tied together for this app. But no other sites have this magic.

If you have an iPhone and a mac, most sites that use SMS OTPs work this way

Linux desktop, android phone.

I've come across dozens.

Google does it. Paypal does it. Duo does it. Lots of single-sign-on systems do it. All of those including not-TV scenarios, just normal computer-and-phone stuff, as well as sometimes other weird flows. Many of these are far beyond what most would label as "security competent", into "login security is a large part of their business and they have significant numbers of specialists hired".

(it is probably safe to say none are "truly secure" or "actually security obsessed", but I doubt that's actually possible in large quantities. the requirements are too steep, for both implementers and users.)

It's not the most common, certainly, nor anywhere close. But it's very far from nonexistent.

Where does Google do this?

Log in on browser -> push notification "is this you?" on your phone -> browser automatically continues when you say "yes".

But that's only as a second factor right?

Is that materially different? It's a login that's completed on a different machine, and automatically resumes on the intended one.