[dalke]

My bank's terms of services say they are not responsible for flaws in the mobile phone or privacy issues in the store.

If there is a vulnerability, who pays for fixing it? Who pays for the new phones?

Of course the credit card companies and banks don't want to be responsible. They currently aren't, and they don't want to take it on.

Why should the regulators care yet? Using a mobile phone is still under the fiction that it's an optional functionality, where the user has agreed to take on the risk themselves, in exchange for better convenience and non-essential services.