What's even the point of all the bullshit with Google play protect if in the end I can access my bank from a web browser. That stupidity is protecting no one
If your bank allows you to access all features from a browser, consider yourself lucky. Mine requires the app to authorize any online transaction.
Unless you get SMS or some normal TOTP app as 2FA, using the web page usually requires the bank's proprietary app to authorize. So you circle back to the the same issue.