I agree with you that it’s bad practice to enter your login date into an arbitrary app.
However, you and the gp should complain to your bank because it’s their job to provide a secure confirmation method. My banks push the confirmation to their app that has separate without the possibility of stealing my bank credentials (in trivial ways).
