Password length isn't necessarily cause for concern in this context. See: https://www.troyhunt.com/banks-arbitrary-password-restrictio...

As for MFA, the only Australian bank that seems to do it right is Macquarie (who let you remove SMS 2FA and replace it with a decent authenticator app). A handful will issue physical tokens on request (eg HSBC).