The article is talking about total economic costs (i.e., to all users, the bank, etc.), not just from the perspective of the banks. In other words, we as a society may lose more by implementing "best security practices".