They're more than MFA codes though: they're actually performing cryptographic challenge/response.
I mean: the RSA tokens just generate a MFA code. But the bank "card readers", whether they actually read a card or not, do perform challenge/response.
I've got several banks using the same type of card reader: I put my bank card in and respond to a challenge: I enter the digits that the card reader shows me and I can log in.
I've got another bank which provided me a reader: it's not a card reader as its standalone (I don't need any bank card to use it) but it still perform challenge/response.
For example for any wire tx to a new recipient or above a certain amount, I need to enter the amount and part of the recipient's bank account number and sign the transaction.
It's more than just authentication.
In between there was a special key-generator given to each customer, that was abandoned about 10 years ago. (edit: it was the RSA SecurID's mentioned in this thread)
Since then we've got apps that need to be activated using a letter with a special qr-code, as well as the bank account-number (username) & password another qr-code from the website. I assume it generates a private key in the app which will not be transferred to a new device (but maybe somehow is). You need to login using your account-number (username) and password, after that you have to open the app (login with face-scan) scan a qr-code and enter the generated code.
Getting a printed out card or page with something on it to verify your identity seems like 20 years tech to me.
Defeats the purpose? Only kind of.