>Sure. But their customers don't, and haven't for decades.

This is a pointless argument. The bank has a contractural arrangement with you and it is their data, so they care, and as a customer you know they care and so you know you're protected. But companies aren't just going to place their data out on any old server somewhere unbeknownst to them, especially when it's sensitive, proprietary data.