How would that attack work?

SIM Swap attacks are what they are referring to, I think.

Or SS7 attack to intercept SMS messages, no SIM swap required.

Doesn’t this require physical access to a compromised mobile network?

Requires that someone has physical access, that they can then sell digital access to.

Do banks really use SMS as an auth method these days?

This is only true in some countries, and tbh. having this as the state of the art, sounds a bit dystopian. I've been using my BankID, which is a Norwegian electronic identity solution, to log into banks and such, for decades now. With these type of solutions, there is no way that taking control over phone numbers make any difference when trying to get access to a bank account.

Btw. this type of electronic identity solution are not Norway specific, I know all the other Nordic countries have them, and they are, as far as I know fairly popular in the rest of Europe as well.

Or if you get your line cancelled for some reason and have no access to your phone number and you are abroad. You’ll have trouble with banks and many other things that use phone number for verification.

Really wish they worked on removing phone number verification before doing any other security/password thing.