What is the point of the new text message security code system.....

400ixl

If they decided they still needed to call you to validate then that suggests you may have entered the code sent incorrectly. Most systems are rightly set up to not say whether you got it right or not.

Either way, they had reason to want to validate you further which you failed to do, therefore it was blocked. This is the crux of the issue, you failed to validate yourself to their satisfaction.

It would likely remain blocked until you authenticated yourself as in control of the card. So if something is declined you need to follow up, not just assume it will be fine next time.

Sometimes it can be over zealous but it is hard to make something secure and non invasive.

Personally not a fan of banks / cards that still use SMS codes and try to use ones which require in app authentication as it adds additional layers of security in that you have to authenticate yourself to the app. These apps also tend to add more 2-way communication in the process as you have authenticated yourself.