> With passwords, no account was even lost in the scenario for a recovery flow to start

Given how common mandatory SMS 2FA is for banks, if thieves stole your unlocked phone, they have stolen your account too.