That's actually an interesting point. I wonder how many sites would be broken by disabling methods that shift window focus, like Window.focus() and Window.blur()? Probably not many...
Every bank website I've used so far does forced pop ups, as well as websites that want you to authenticate yourself using some other service (such as Google, or Facebook.)
Why not implement a good 2FA then to avoid the problem entirely? The way I see it if someone can steal your bank login details using iframes as a weapon then the bank is doing something wrong. Banning pop-ups entirely would force the banks to shape up
