Which, in general rely on your users email password .. which may not be as secure as their bank password, because "email doesn't handle money".
So, to access your bank now crackers just need to get in to your email (which may be true anyway, of course 2FA helps in both cases).