I think you've missed the point. It's not sufficient to let the user decide how much security they should have. It won't protect the banks from the expectation

I think you've missed the point. It's not sufficient to let the user decide how much security they should have. It won't protect the banks from the expectations of security placed on them by others, however unreasonable that might seem.