The settlement detailed the missteps PayPal took in the lead-up to the attack and highlighted common risks — both on compliance and security — banks face.