I think the logic is the same.

Having the possibility/capability of intercepting the SMS is only effective if the ID and PIN are already known, and while surely there are "other" ways to get them, the attacker needs all three.

From what I have read/seen, most if not all successful attempts to access someone else's bank account online go through some form of phishing.