why would you trust a physical location who typically wouldn’t have a robust architecture or any opsec but not trust an online first business that likely has op

why would you trust a physical location who typically wouldn’t have a robust architecture or any opsec but not trust an online first business that likely has opsec and monitoring?