So basically, since you need to be targeted as an individual rather than at random, and that's rare, then we should be okay with an insecure /banking/ website?

So basically, since you need to be targeted as an individual rather than at random, and that's rare, then we should be okay with an insecure /banking/ website? I can't get my head around that point of view. This creates a financial incentive for people to scour the internet for people's phone numbers, clone their SIM and steal their PayPal account and so you can be fairly sure people will do that.