A lawsuit filed in Tennessee earlier this month has resurfaced questions about a bank’s responsibility in protecting customers against cyberheists.