No.

They aren't. That they can be used as such does not make what you said true.

Hum ... like what ? It is quite critical, someone with your username/passwd would be able to call for several hours without you knowing it.

A lot of banks don't support two-form authentication. A lot of online merchants keep credit card information on file and allow for quick check-outs.

And they count on being able to use your phone to confirm identity. Someone could hack your bank and phone at the same time so when you get a call about the suspicious transaction, it really goes to the hacker who says "yep, that was me".