I don't think it's gullibility, but I doubt that it's liability, either. Why would the banks give a moment's thought to what Troy thinks about their security?

I don't think it's gullibility, but I doubt that it's liability, either. Why would the banks give a moment's thought to what Troy thinks about their security? Even if he went on national TV telling everyone that this is terrible, they would just roll out their normal "While we appreciate the feedback, we are confident that our systems are secure" line. The vast majority of people don't know who Troy is, they don't have any understanding of IT Security, and having some random computer guy rave about bank security is going to mean nothing to them. The few that might be marginally concerned over hearing it are almost certainly going to be persuaded by the bank's IT Suit that's rolled out to deliver the line.