I believe there are three levels -- password only, otp and otp after you tap the id card in the app (I think it's just once).

My healthcare provider changed their online thing this year and that new thing required highest assurance level. I think they changed it back because you can only tap with the Dutch id card (not the residence permit or other country's ids).

Once specific task was linking an Apotheke to my healthcare provider. SMS was not allowed for this flow. I've seen other scenarios, but I don't recall them.