Maybe I just didn’t see the attack vector clearly, but it appears Krebs and security issue is that a scammer can target you, sign you up for this, see that you are a CapitalOne account holder - THEN use that information to further attack you say by opening a new account at the same bank.

Seems like a pretty flimsy side information gathering service. If an attacker has enough information to add an account for you, they probably have enough to determine where you bank at.

Good that the USPS can fix it easily enough, but maybe I’m missing how scammer would otherwise use this info.

They've "fixed" the loophole by sending you a physical letter with a pin number that you have to input onto their website to activate the service. However, someone that's targetting you could still steal your mail with the pin.