I don't think it is possible at the moment to limit a certain device access to accounts/type of actions based on the used device.
Assume: a private mobile and a cooperate one as a specific example.
For example for a business account I require a personal bunq identity with for example only a savings account, but perhaps with way more of course.
I than also have other accounts like a business one (or perhaps a few connected ones)
I want to be able to enroll my new device (default no data is visible) and setup a restriction(or better whitelist) that my corporate phone can only access the business ess accounts it is intended to see/use
To make this happen there must be a way to upcast yourself on bunq web or your primary device (not allow you to lock yourself out of some of the accounts) to a mode where you can manage the device restrictions.
Combined with https://together.bunq.com/d/54785-suggestion-support-webauthnhardware-keys a more robust/secure setup can be created for those needing it.
Why would access to IT systems require these things and bank accounts way less. Especially with the support bunq has by supplying access to different and a lot of account via 1 bunq account.