Zeus and other malware have shown they can be patient, waiting for the legitimate user to log on, then hijacking a session and committing transactions on a user’s behalf. Banks had to quickly adapt to this world by looking at transactional risk – does Todd normally use a cyrillic keyboard? does Todd often move large sums of money in the middle of the night? Is Todd really logging in from Kuala Lumpur 20 minutes after logging out in Baltimore?

NIST’s models haven’t kept up with this change in risk management requirements. We can’t authenticate Todd at the front door and let him roam freely. Instead we need to think about Todd’s transactions and activities – is this behavior normal for Todd? Is it normal for other people like Todd? Is this transaction abnormal for Todd? The answers to these and other questions will feed risk decisions for every transaction – including some very high-value transactions perhaps un-imagined in the traditional model, but completely in line with today’s online reality.

Also, IMHO, door step authentication is not the only method for the risk mitigation.
It is fine as long as the risk is mitigated / accounted for in some manner.
It is perfectly fine to compliment the weakness of the technical measure with
operational or financial controls, sometime somewhere during the course of transaction.

It’s really a lot worse than that. Even level 1 requires that re-authentication cookies be only valid for 12 hours, and some authentication still doesn’t use TLS. In my experience, most commercial transactions happen somewhere below LOA 1.