And surprisingly I can pay securely using my PC, fully rooted, on FOSS software. Hardware tokens have been a thing for decades. There are more second (or third) factor authentication and signing solutions than I can enumerate.
Do peope get defrauded using online banking? Sure. But usually not in a way that would be stopped by secure attestation.
Most banks don't know hardware tokens are a thing. They want everyone to use their app.
The hardware token is itself a form of remote attestation. The reason you need extra hardware is because the PC can't do it.