[jauer]

We bother with TLS for accessing online banking because we don't manually build site-to-site VPNs between our house and our bank, unlike hospitals which have dedicated IT staff, a ton of security appliances of all types and, if they are in the same metro, often have dedicated waves or dark fiber between them.

[jasonjei]

The very problems that plague the unprotected networks to the site-to-site VPNs are the same: all it takes is one piece of malware. In fact, the complacency is the alarm. Just because you are in a "protected" network doesn't mean there aren't bad actors. The bad actors can get in, all they need is to find where your walls have a crack. There's a reason we call it Computer Insecurity.