The problem isn't theoretical, just sufficiently unlikely for them to take no action at this point. Consider the scenario where my phone is stolen and the thief transfers money out of my bank account with Venmo (which has no passcode or similar auth). It's unlikely, but not theoretical.

I think it's quite conceivable that both examples would never happen. And then if it did, is it that big a problem?

I would think twice before using a service that makes no effort to protect me in case of thieves or wannabe hackers. Of course, degrading the service because of security is an old and very common problem, but maybe the sweet spot would be to degrade it minimally, so that everyone gets a lot more security for just a bit less of Magic®?

Well, with Magic there is almost always a geographic aspect to fulfillment which would ward off most/all theft attempts. The time to perform risk mitigation is when a strange, large request comes in.