How do you prevent it though? My understanding is that it’s genuinely hard in crypto. Any automated access control must be baked into smart contracts, which are very limited in terms of the logic they can implement (in practice - in theory Solidity is Turing complete Id imagine).

A bank API can be 10-100s+ kloc if they need that to implement access controls.