That policy may appear unwise, but to judge banks' security, there is enough evidence available without resorting to any such theoretical model of what's secure

That policy may appear unwise, but to judge banks' security, there is enough evidence available without resorting to any such theoretical model of what's secure and what's not. And that evidence is pretty clear. I do not remember any hacking incidents resulting in large-scale losses to consumer, so they seem to be doing something right.