I believe the ruling is correct, the judge is just saying 1FA is "what constitutes “commercially reasonable” security." Which I disagree of course, but who am I to judge (I'm sure the judge knows more about this than an IT professional).
Consumers should boycott using IT banking from such banking systems and stick to those who have implemented 2FA. Not sure about US, but where I'm from, nearly all banks have that implemented, and still people worry about the security of internet banking, what with RSA's announcement and all. Doubt anyone would even consider using that with one that doesn't have it here