How to regulate this is up to each and every country, just like it is up to each country how to regulate things like pollution, traffic and infrastructure.

That a bank who can't handle security compromises their customers user experience rather than their customers security is a good thing.

The reason the regulate these things aren't because it is fun. It is because there are fundamental security problems that needs to and will eventually be fixed. Companies like Apple have largely already, or at least potentially, fixed these problem just only for themselves. If you want to fix it for everyone you very likely need some sort of mandate.