Most security experts a bank would reasonably hire are not bank robbers, you know?
Yes, it would be useful to know how exactly that happens.
I suspect that a part of the answer is how formal employment and long-term career changes the cost:benefit balance. Like, if you are not employed as a security expert, and rob a bank, you have an X% chance of getting Y money, and Z% chance of ending up in prison. If you get hired as a security expert, that increases the X, but probably even more increases the Z (you would be the obvious first suspect), and you probably get a nice salary so that somewhat reduces the temptation of X% chance at Y. So even if you hire people who are tempted to rob a bank, you kinda offer them a better deal on average?
Another part of the answer is distributing the responsibility, and letting the potential bad actors keep each other in check. You don’t have one person overseeing all security systems in the bank without any review. One guy places the cameras, another guy checks whether all locations are recorded. One guy knows a password to a sensitive system (preferably different people for different sensitive systems), another guy writes the code that logs all activities in the system. You pay auditors, external penetration testers, etc.
There is also reputation. If someone worked in several banks, and they those banks didn’t get robbed, maybe it is safe to hire that person. (Or they play a long con. Then again, many criminals probably don’t have patience for too long plans.) What about your first job? You probably get a role with less responsibility. And they probably check your background?
...also, sometimes the banks do get robbed; they probably do not always make it public news. So I guess there is no philosophically elegant solution to the problem, just a bunch of heuristics that together reduce the risk to the acceptable level (or rather, we get used to whatever is the final level).
So… yeah, it makes sense to learn the heuristics… and there will be obvious objections… and some of the heuristics will be expensive (in money and/or time).
Trying to summarize the method:
list all know facts
list all competing theories
make an M×N table, highlight places where the fact contradicts the theory
require an explanation for each such place in the current theory
if a new theory is made, add a new column to the table, and evaluate all cells in the new column
I guess this mostly avoids the failure mode when someone uses an argument A to support their theory X, later under the weight of evidence B switches to a theory Y (because B was incompatible with X, but is compatible with Y), and you fail to notice that A is now incompatible with Y… because you vaguely remember that “we talked about A, and there was a good explanation for that”.
The admitted disadvantage is that it takes a lot of time.