Why don't most banks have a system where, when you charge something on your credit or debit card, you then have to log into the bank and approve the transfer of funds? Alternatively, why don't they offer 2-step verification via sms for all transactions? Why don't they have settings that you could customize that would require you to approve the transfer only above certain thresholds or in certain locations or if the business is on a personal blacklist or isn't on a personal whitelist? Why don't we use one-time-use keys generated on banking websites instead of CC numbers for transactions? It just seems really strange to me that money can be withdrawn from bank accounts simply by knowing the CC number (semi-private), CVV (semi-private), CC expiration (semi-private), name (public), and address (public).
The answer I am expecting here is that it would be slightly inconvenient to do these things, but I see no downside for the bank or the customer if the customer is not required to opt-in. This answer would not make sense unless these measures are forced upon customers.