Yes. It's a step too far... Banks are too used to holding all the cards and people having to follow their rules.
TOTP is public for a reason. RFC 6238 has been sitting at the IETF since May 2011, and the whole document runs to sixteen pages. Anyone can implement it. That is exactly what makes it useless as a gate: the digits come from a secret you own, and no vendor gets to decide who may compute them.
Attestation has no such document, and it never will. "This phone is genuine" cannot be answered by reading a specification, only by asking whoever manufactured the hardware and vouches for it. No bank buys a better lock with that certificate. What it buys is a name to point at when the money is gone, and liability is the one part of banking that has never been up for negotiation.
If you want to see where the pressure lands, watch the website. As long as you can log into the bank from a browser with your own TOTP app, the device in your pocket stays your own business. Each time that door is closed and the app becomes the only entrance, the certificate turns compulsory. The card game you are describing is being rebuilt one login page at a time.
Attestation has no such document, and it never will. "This phone is genuine" cannot be answered by reading a specification, only by asking whoever manufactured the hardware and vouches for it. No bank buys a better lock with that certificate. What it buys is a name to point at when the money is gone, and liability is the one part of banking that has never been up for negotiation.
If you want to see where the pressure lands, watch the website. As long as you can log into the bank from a browser with your own TOTP app, the device in your pocket stays your own business. Each time that door is closed and the app becomes the only entrance, the certificate turns compulsory. The card game you are describing is being rebuilt one login page at a time.