To run with the analogy some more: The bank is expected to have people trying to break into it. Sure would be nice if they didn’t, but that’s not the reality.

To run with the analogy some more: The bank is expected to have people trying to break into it. Sure would be nice if they didn’t, but that’s not the reality. As such, failing to provide adequate defences is absolutely a failing on the banks behalf. If they were keeping even more data than necessary, that’s just extra failure on their behalf.