It's used, as far as I can tell, because banks don't want to have to explain to millions of customers how to use anything else.
It's perfectly fine if people want to use it, but at least provide the option for TOTP or hardware keys behind a big scary warning page or something.
Also because once they get that number under the guise of needing it for security they can use it for marketing texts. It's a win win!