I’d say the real problem is not the technical insecurity - that’s a result. The real problem is in the last paragraph: the fact that banks are incentivized to use insecure mechanisms by being able to shed any responsibility simply by denying customers claim.