It is as simple as that, except:

1) everyone can run into the lethal trifecta

2) the product cannot, on an architectural level, be fixed to stop it

3) they are helping the maker of the product go to IPO

If banks are not stupid, they'd say "hey, this presents an unacceptable risk to our customers and by extension, to us, maybe this isn't something we should be involved with".

But no.