A few questions about the application of ethernet controller and PHY chip and SFP module
The problem is many micro-controllers don't have transceivers built in, which require impedance control (and most likely add to the cost of IC development). The other problem is clocking, which low speed processors do not have clocks that support SERDES or transcievers. It really is determined by what interface the processor can support.

Another question is that, if the controller's serdes directly
connected to SFP module (without PHY on the module), which
protocol/interface will be used between controller and SFP module?

The biggest determining factor is what Media dependent interface the processor can support (MII, RMII (50MHz), GMII (125MHz), or SGMII (serdes w/ trancievers)) Find what the processor can support, then that will determine what interface needs to be used.
An installation like this is usually when the microprocessor can't support A GMII or faster interface, and the phy translates between the microprocessor and the controller. Marvell makes some PHY's that can do that kind of translation.
controller ==&gt; PHY chip ==&gt; SFP module ==&gt; fiber cable

About the controller, since it has the ability to directly interact with the SFP module, why the PHY chip vendor still need to implement the function to interface with SFP module?

No, that would be a waste, if you can do (for example) GMII on both the microprocessor and SFP, then no PHY is needed.