From a technical perspective, I agree with both of your points.
From the perspective of dealing with my bank, my desktop being compromised by malware that results in bad things on my bank account, is something that could happen to a large number of their other customers. There will be policies in place, and there is a stronger defence that the money was stolen, and not that I was negligent in my security practices.
In the event that I opted to break the end to end encryption between my browser and their server with my own middleware, it will be argued that I am technically competent to manage my IT security properly, and that the bank cannot be faulted for my failures. They could try this defence on the first instance too, but given that one scenario impacts everyone, and the other only impacts people who have declared that they know better, I don't expect much sympathy for the latter group.
From the perspective of dealing with my bank, my desktop being compromised by malware that results in bad things on my bank account, is something that could happen to a large number of their other customers. There will be policies in place, and there is a stronger defence that the money was stolen, and not that I was negligent in my security practices.
In the event that I opted to break the end to end encryption between my browser and their server with my own middleware, it will be argued that I am technically competent to manage my IT security properly, and that the bank cannot be faulted for my failures. They could try this defence on the first instance too, but given that one scenario impacts everyone, and the other only impacts people who have declared that they know better, I don't expect much sympathy for the latter group.