So the EU attempts to invade your privacy using smartphones [1] and forces duopoly-brand smartphones upon its citizens, yet it fails to compel Apple to allow true sideloading, so you're stuck choosing between "no freedom but some privacy" or "no privacy but some freedom"? Their digital policy initiatives overall seem like a net loss for EU citizens as it stands.
I was trying to make a case that when you add up everything the EU has done recently with regards to digital policy, you get a net loss for EU citizens. Their attempt at chat control decrements the score by a significant amount. Amending the DMA to have it not be completely useless would increment it by a significant amount, but it is unknown if that will happen yet.
They don't offer hardware tokens by default. Often you can request one (you will be charged). I did just that despite it not being advertised option. I just said I need one.
I think all banks in my country as well provide hardware token method (used to be paper cards, nowadays a small Tamagotchi like device that outputs codes) if you don't want to use a phone app.