You might think the exchange, but - both may be making the security trade-offs that make most sense for them.
The bank has insurance; they can blame customers for some of what insurance doesn’t cover. If they get too technical with the security, they may (they reason) alienate non-technical customers and send them to other banks. So, the bank needs to minimize the money it loses - balancing the hacking losses it can’t pass off either on customers or insurers, against losses due to customers getting annoyed with all this SMS password rigamarole, and switching to a bank offering less cumbersome security measures.
