It makes sense : their business it not security. Companies use them for that, and never asked for permission, they don't have to honor it.

Alhough as a customer, I'd like my phones not to be redirect to anybody asking for it, but I understand they don't have the security measures a bank should have.