[Cthulhu_]

In theory, yes. Which brings us to the question of liability in the case of hacking.

On the one side, if you got hacked to that degree - root account, MFA, e-mail, etc - you really fucked up, to be very blunt.

On the other, it's down to Microsoft to provide good security and protections - e.g. spending limits, with a "contact us" and mandatory waiting period if you're about to go e.g. 10x over what you normally pay.

Banks (at least here) offer you a kind of insurance; if you get hacked, they can lock your account and return you your money. Their reasoning there is that they messed up and didn't make it obivious enough that you're about to, for example, send X amount of money away. (this is one reason why cryptocurrencies will never replace banks)