>If credentials are stolen, crypto or otherwise, a scammer can then use those stolen credentials to make a payment.

Crypto credentials are not comparable to bank credentials. Crypto credentials are a public key; you still need the secret key in order to authorize a payment. Credentials are insufficient to make a crypto payment.

Bank credentials are usually just open-source information that anyone can get a hold of, and they are usually sufficient to make a bank payment.