In most places a large number of aberrant transactions that don't match the historic spending patterns of an account would be enough to trip a security review,

In most places a large number of aberrant transactions that don't match the historic spending patterns of an account would be enough to trip a security review, and a call to the account holder, temporary freeze, etc are low impact to false positives and highly effective at stopping fraud. So yes, because we afford massive protections and rights to banks in exchange for the necessary but largely low-risk activity (holding cash then returning it in exchange for a fee) - laws holding them responsible for failing to prevent theft do exist.