You're right that the risk profile isn't just volatility. In a system where "you are your own bank," losing a seed phrase, signing the wrong transaction, or getting phished is equivalent to someone draining your checking account with no recourse