Well any risk is going to be paid by the customer in the end. If they lose 0.01% of their deposits because of a vulnerability, they're gonna be charged more by their insurance and eventually charge it on their service fees to customers.
You're implicitly suggesting that the bank can either pass on the costs without people noticing, or that they have no competition, so they can set fees and interest rates to whatever they like. I don't think either is true. We do regulate banks, and this is why it's vital.
You could just as well say the cost is going to be paid by the shareholders, the public (in the form of reduced taxes), or the employees.
