The problem we are attempting to solve is that a third party app is demanding access to your bank account, but you only want to enter your password on the bank page. So the trust that needs to be establishmed, is that a page (being shown by the app through webview) is a genuine bank page and you can go ahead and put in your password there.
Bob is impersonating you in the first place and asking for the password. How do I know whether it is you or him?
Bob sends me a code, I type it in to his phishing site. So what? It doesn't actually result in him gaining anything useful because I still haven't revealed any banking login credentials.
Bob is impersonating you in the first place and asking for the password. How do I know whether it is you or him?