Nail on the head. They don't have any choice/discretion. The computer will keep asking questions and they need to be answered. It's not as if the phone operator will have open/unfettered access to the company database - there'll be all kinds of controls, etc., that they'll have no choice but to go through to get from one area/screen to another. In many cases, the phone operator will have virtually the same screens as you do by logging into your own computer - they "may" have slightly more permissions and functions, but usually not much, if any.
The thing is that people will try to abuse the system, whether customers phoning in, or even staff, so controls need to be in place. You could say you don't need to go through security if, say, you're phoning your bank to ask for a copy statement to be sent, or for a paying in slip book, as they're not security risk tasks, but if the operator logs in and does that without checking you out, it'd be easy for them to get suckered in to confirming your balance etc if there weren't controls, so it's safer to have to go through security before they can access anything, so at least they know it's "you". Also, you don't really want random customer service staff being able to log in to someone's bank account just for nosiness or even worse, to steal money, etc., so they aren't given access without the customer giving the security details to them.
At the end of the day, they don't have access to the data, until you give them your security details which is what grants them the access.