Why verifying within the same channel proves less than it seems to
Out-of-band verification confirms a request through a channel entirely separate from the one it arrived on — calling a phone number already on file to confirm an urgent email request, rather than replying to that same email or calling a number the email itself provided. This matters because a request convincing enough to pass as legitimate within its original channel will, by construction, also pass any confirmation attempted through that identical channel — the check and the thing being checked share the same potential point of compromise.
Genuine independence between the request channel and the verification channel is what actually provides protection. Verifying through a channel the original requester also controls, or that they supplied as part of the same suspicious request, adds the appearance of a check without its substance.
Reserved for stakes that justify the friction
Out-of-band verification is deliberately more effortful than an in-channel confirmation, which is exactly why it's reserved for genuinely high-stakes approvals — a large fund transfer, a change to an account's core security settings — rather than applied to every request. The specific defense it provides matters most against exactly the scenario notification spoofing and social-engineering attacks rely on: a request convincing enough to defeat any check confined to the channel it arrived through.