But I don't get it. I've helped out with security at a bank, and one of our big problems was persistent and very advanced efforts by malicious actors to comprom

But I don't get it. I've helped out with security at a bank, and one of our big problems was persistent and very advanced efforts by malicious actors to compromise endpoints. I've seen Trojans that would detect keypresses that look like bank accounts, take a screenshot and put it on top, replace the bank account number and then, seriously, detect with ocr on the confirmation page where the replaced account was and replace it there too. And these were made to steal amounts like 2k euro, maximum. I mean I guess that's still 2k euro * 1000 or so victims, but still (they do it this way because of 2FA, the customer must confirm on a second device, the little irritating calculators, the transaction) Everything depends critically on endpoint security. You cannot make this work securely. I mean a simple Trojan could simply fake a logout, then transmit the screen + keypress control to an attacker. And I would add: your enterprise security is not just dependent on a device you don't control, this also represents a "get out of jail free" card for malicious insiders. If they just make sure to have 4-5 viruses installed on their home machine, whatever they did in the company machine is excused ...