I had a Bank of America token-card (the one with the LCD display and button) until they discontinued it. Those things are fine. It was no larger or heavier than their ATM card, and in fact some banks combined the two into a single card. There was no need for any FIDO-like standardization or certification authorities there because the same entity (the bank) had provided both ends of the authentication conversation (the token card and the bank's website).

If a bank feels the need to control the hardware I use, they must provide that hardware. Their needs absolutely do not entitle them to impose codesigning/bootloader-locking requirements on my other devices, such as my phone or my laptop.

> aren’t doing attestation checks, and it’s discouraged

That will change. If it weren't, they wouldn't have bothered putting it into the spec. Or they could have used symmetric cryptography for attestation, like the bank-issued token cards and the chip in your chip-and-PIN card do.