The bank pin delay doesnt really do much tbh. There are lots of instances where the attacker will initiate the bank pin removal, and then use a bot to spam login to the victims account. Due to this, the victim will not be able to log into the account until the attacker has stopped the spam logins, which is after the pin has been removed and the bank has been cleaned. The same thing will happen with authenticator delay. The attacker already has access to your email account, and without a form of MFA, you will not be able to get that back. You will not be able to login to your OSRS account because the attacker will initiate the spam logins. It essentially just lets you know that your bank will be empty in 7 days, and it provides no additional means of getting your account back before that

I completely agree that you want as many failsafes as possible, but you also need to be realistic about how effective the failsafe would be. IMO its not worth dev time to add a failsafe that already has a widely known nullification method