My coworker has a regular checking account. One day he noticed he had something like $20K missing. He called the bank, they have a long conversaton, put him on hold, long long hold, then they say "Your money is back, let's never talk of this incident again".
If he hadn't noticed it, he would be out $20K.
The ability to irretrievably lose massive sums of money with no recourse is a challenge for Bitcoin. Banks have insurance for just this sort of eventuality. Cash is relatively hard to steal in gigantic quantities.
I find it funny that you pose the problem and give the solution in such close proximity. (In case you miss my meaning, the solution is to trust large wallets with third party companies that insure their holdings and guarantee your money even if they are successfully attacked)
The FDIC isn't really relevant here ー it doesn't really insure against theft or bank error. But banks have other insurance which does precisely that.
I am sure there are already virus and malware out in the wild which target private keys.
Offline wallets are the only way around this - but eventually the user will need to use their private key to move those funds.
They are equivalent to DMZ servers; hold only what is necessary for the service and be prepared to drop them quickly if problems occur.
The real money ( such as received salary and savings ) should be in firewalled deposit-only accounts ( like servers in the secure internal network ). Push from the salary receiving account to checking when necessary. Don't accept any requests from the DMZ.