I asked my bank about this and they forwarded my question to their security department and the reply was "don't worry - you aren't responsible for fraudulent transactions".
My fear and supposition is that someone's storing the password in cleartext in some ancient SQL database somewhere, or blindly working from design specs that assume that.
There are some alternate, more charitable explanations, mostly to do with UI or UX, but none of those are particularly more encouraging.
For me, and I'd guess a lot of other people, I don't care if the money can _eventually_ be returned, I'm concerned for the day that my life savings goes missing and I have to spend days or weeks stressed to shit about when or if I'll get it back, meanwhile not sure if I can pay rent.