AFAIK today if you buy a device, the bank doesn't get the device-unique identifier, at best it sees the model number.

Verifying identity works best when the stakes are high. And there are highest in online banking.