It's never about security or end user protection. It's to give banks a blanket refusal of responsibility.