You can believe what you want, I guess, but that does not change reality. The company also has a vested interest in marketing your account security. They also lose out when accounts on their system are compromised. It seems a bit ridiculous to say that only one of the two parties who have a vested interest in security here gets to set the rules.