> they don't understand what they are talking about
Even though the banks' policies are driven by incident responses and real data, whereas your position is presented on theory.
As someone who worked at a bank - some policy decisions are not driven by regulatory requirements or technical expertise.
Is your answer driven by real data about the decision making of banks?