The second factor is the one time password. You get ~200 by snail mail and need one for each transaction. So you only give up control for one transfer. But yes, indeed, this is insane.
But then again ... you just handed your banking credentials to some shady fintech startup.