Personally, I find the most interesting thing about security and privacy is the challenge of making the right choice in different contexts. Suppose a hacker takes over an account. If this is discovered, the account can be completely blocked in a maximum of one hour. An assessment has been made in which the remaining risks are regarded as acceptable. The old school bank principles are or were based on, among other things, you have what and know what about me and the use of one-time passwords in a financial transaction. As long as the residual financial risks are also small here, it is acceptable to the bank. Facebook is based more on collecting and selling as much information as possible.