If a bank allowed people to log in to their bank account and make transfers based on only email+password and someone stole money from a bunch of accounts, would the bank face any criminal liability?

I don't know the answer, but I would say your DNA sequence should be secured similarly to your bank account.