I'm guessing that if they had a major breach because of this kind of idiocy, they'd find a way to fix it after the fact. Which sort of implies to me that they

I'm guessing that if they had a major breach because of this kind of idiocy, they'd find a way to fix it after the fact. Which sort of implies to me that they should find a way to fix it before they have a big breach. If nothing else, the fact that they've been warned repeatedly and done nothing could be pretty compelling if there was ever litigation over losses. For example, I could imagine someone successfully disavowing a trade at Schwab because they don't enforce the password authentication they claim to, and thus can't convincingly claim that the trader was in fact the account owner.