Whenever someone says "...but why don't we just implement a security feature which denies access to clients that try to do X?" where X is something extremely vague like "steal money" that is really hard to translate into an algorithm that could conceivably be implemented, I reply by noting that unfortunately their idea won't work since malware authors have such a low rate of RFC 3514 adoption.