This assumes that:
a) the architecture being analysed is an adequately realistic replica of reality; and
b) the system is simple enough that analysis can, in principle, discover the flaws.

I agree that analysis is a necessary ingredient, and usually the most cost-effective approach. But it is rarely adequate by itself. There are plenty of theoretically secure systems which in reality have yawning holes that you don’t notice until you start actually poking around: the firedoor propped open for the smokers; the password that scores high on a password meter but can be guessed by anyone who sits at his desk for 5 minutes; the Ardennes Forest.

I wouldn’t mind betting that GetCash scored high and dry on a static architecture that assumed that mobile phone security was the phone companies’ problem: “out of scope” for the bank. Thus blinded to a whole line of approach, they didn’t notice that GetCash can be defeated with mobile phone shennanigans that don’t involve violating the phone companies’ security policies.