(I was very surprised when I moved to the US and realized that changing your address here means going to every single government agency and business you have a relationship with, and independently changing your address with them, instead of just doing it once in the central registry. I also found out that apparently you can't change your name on your driver's license if you have unpaid parking tickets. This is hilarious and unfathomable to me)
The mobile bank-id is still passcode-protected. The way it works is that whenever I want to sign on to one of these sites, I just enter my public personal id number. The app will then wake up, tell me that someone wants to identify as me on site X, and to enter my passcode if that's correct. If you steal my phone and don't have my passcodes, you can't do that. And I can revoke existing certificates if my phone gets stolen so they don't work even if you know my passcode.