Fair, until you have to shop with merchants that don’t allow cards without 3D-Secure support… also, push notifications are great, I think that’s best too.
Worst is an implementation like Danske Bank (Northern Ireland). EVERY transaction requires an SMS code. No alternative. Thus, no online purchases when you’re outside Europe unless you want to pay roaming fees sigh. SMS isn’t even that secure… it’s… meh, secure enough for this. Kinda.