What's up with the questionable security with banks and financial institutions?

Every time I log in to my fidelity account they ask for 2FA from my mobile which is good, but they also have a text message fall back which is not the most secure same with chase, but they only sometimes ask for mobile auth most of the time it's text or email. Like even accounts that don't need to the most secure are better than financial institutions, like Reddit, Twitter, LinkedIn and whatnot, what's going on here, and why …

2fa account ask auth back banks cybersecurity fidelity financial financial institutions good institutions log message mobile security text text message