I use GnuCash/aqbanking on Linux with a physical TAN generator myself to access my German bank account. The fact that this works is not up for debate.

My point was that you can't do it *without hardware attestation*. You can choose between 1. a smartphone with hardware attestation, or 2. a physical TAN generator with hardware attestation.