I use GnuCash/aqbanking on Linux with a physical TAN generator myself to access my German bank account. The fact that this works is not up for debate.
My point was that you can't do it *without hardware attestation*.
You can choose between 1. a smartphone with hardware attestation, or 2. a physical TAN generator with hardware attestation.
For the website, it's also easy, even with PSD2 you can just get a physical TAN generator.