That sounds obnoxious they don't support the usual MFA platforms
And at the same time there's Fidelity (and others) using voice authentication as the sole verification of account ownership when calling in (I think they finally fixed this a couple years ago)