Banks have little to no control over this. Banking regulation E controls this aspect.

So yes, a reason to keep it at your bank (which is regulated heavily).

Some countries (like South Korea) are in the "customer are never in fault", other countries are "users have sole responsibility for their security", but US is in an ambiguous position where you need a court to determine responsibility. If someone said that a US bank didn't pay out for a hack it means that either they're poor to ligitate (understandable, the US legal system is rigged) or they're hiding something that would persuade the judge to side with the bank. This is still the case despite the "we're not responsible for hacked accounts" ToS especially if the bank is the one who fell for social engineering attacks to falsely convince to do something that was unauthorized.