Yes. PCI is a silly substitute for actual security. But the alternative is that many banks and their partners will run with no security because bank executives

Yes. PCI is a silly substitute for actual security. But the alternative is that many banks and their partners will run with no security because bank executives as a class are firmly opposed to sharing authority with competent IT security people. This is one cost of their class solidarity.