SIM Swap attacks are what they are referring to, I think.

Or SS7 attack to intercept SMS messages, no SIM swap required.

Doesn’t this require physical access to a compromised mobile network?

Requires that someone has physical access, that they can then sell digital access to.

Do banks really use SMS as an auth method these days?