Yes, and WhiteHats would raise those security concerns with the company, privately, and work with them to get it solved. If the company didn't work to fix them, that's when you raise it publicly.
And if clients don't know how secure their bank is, they don't really have a choice other than guessing.