Is there any particular reason why the Steam application attempts to be so secure? It seems to force you to take more security measures (two-factor authentication, emails confirming all trades, etc) than most banks do.
Is this due to the fact that the Steam software has some inherent security risks associated, or is it just because they want to avoid people complaining that their account was hacked?
Is there any reason that Steam attempts to be more secure than most banks?
Steam has about 100 million users (random link saying they had 75 million almost 2 years ago). If they spend on average $10 per year, we're talking $1,000,000,000 per year - and I'd say that's a conservative estimate (random link saying they had 1 billion in revenue back in 2010). That's the same kind of money small banks deal with.
Then there is almost certainly a large number of low tech attackers. Steam is used by a lot of kids who don't yet have a proper understanding of legality, so at least some of them will try to steal the account of that other kid that smells funny. To be clear: "some" of 100 million is "lots". These attackers often live in the same town and maybe even saw the other kid typing in the password before, which breaks some traditional safeties based on IP range and passwords. Stolen accounts create customer support costs. Widespread reports of stolen accounts create bad press, which destroys trust. For a digital market, trust is money.
Valve also works with a huge number of partners. These partners can act maliciously and try to break/abuse the billing process, which will directly hurt Steam's reputation and therefore lose Valve some serious money, unless the abuse is detected and dealt with swiftly.
EDIT:
[...] enough money now moves around the system that stealing virtual Steam goods has become a real business for skilled hackers [...] We see around 77,000 accounts hijacked and pillaged each month. - 9 Dec 2015 http://store.steampowered.com/news/19618/
So in addition to a large number of low tech attackers, there's a large number of high tech attackers as well.
I think it's very understandable, especially why they feel the need to force security measures on user:
The real reason is fraud. A typical scam looks like this:
Now money that would have otherwise gone to Valve goes to the scammer's pocket instead. This is also the reason items that are purchased on the Steam Market are untradable for 7 days.
Valve is privately owned and does not publicly publish their financial statements, but similarly large companies like Sony and Microsoft lose millions a year to these sorts of credit-card fraud.
Another thing that is not mentioned in the other answers is the impact of Valve's structure as a company and their philosophies for scalable solutions.
Most Valve employees (if not all) are hired into Valve's culture where each person works on the project of their choice, especially if they feel it is the most valuable contribution they can make to the company. For understandable reasons given this culture, few employees at Valve take interest in customer service/complaint handling.
In addition, Valve views community-driven/game-ified solutions as a principal way of making features scalable. See also: Steam tags, reviews, etc.
For these reasons and because Steam had suffered a rash of account thefts due to the large real-world value of TF2 and CS:GO items, Valve naturally alighted on two-factor authentication as a user-driven way of cutting down on the number of mind-numbing account theft cases they had to handle. They further game-ified adoption of two-factor authentication by making a new level of the community badge and adding two-factor authentication as one of the activities, giving a limited time discount on Steam marketplace for two-factor authentication users, etc.
To sum up, another reason Steam is insistent on security is to free software engineers up to do more engaging work.
Update 12/10/15: As Valve has just explained:
Account theft has been around since Steam began, but with the introduction of Steam Trading, the problem has increased twenty-fold as the number one complaint from our users...
We see around 77,000 accounts hijacked and pillaged each month. These are not new or naïve users; these are professional CS:GO players, reddit contributors, item traders, etc.
Restoring 77,000 accounts per month adds up to a ton of time that engineers could be spending on other things.
At this point, some people have thousands of dollars' worth of games in their account. To be sure, Steam accounts are not exactly liquid, and you can't easily convert them to cash (though I guess you could ransom them), but the potential loss is still there.
On top of this, many people have game accounts linked to their Steam account, such that if you control an account you can control their in-game account as well. From here you can siphon away many in-game items, such as TF2 weapons and hats, which can then be sold on a market for either real cash, or in-game money which can in turn be converted to real money through some grey market.
Of course, some people also have actual money available to their account, with features like Steam Wallet. That's not to mention any Credit Card information that can be gleaned.
Adding to the issue is the fact that people love to complain that their account was hacked, especially if they got banned for cheating ("a hacker/my brother/the dog did it!"). There are of course many hackers actively trying to take over Steam accounts as well. I think this is the real reason for the strict security, since, say, an Amazon account is likewise "dangerous" but doesn't have nearly as much security protecting it.
Also, when contrasting (as you did) with banks, keep in mind two important points:
As other answers mentioned, many reasons for Valve's security measures are fraud, your account could have hundreds or thousands of dollars worth of games and tradable items, payment information is linked to the account, and you can essentially use that account to buy anyone else games and tradable items.
But another reason everyone overlooked is your Steam account gets you logged into more games than just Steam. Game developers can use Steam's account APIs to use them as their authorization system. Kind of like how you open CS:GO and you are already logged in as long as Steam is logged in. If you have a key that opens many locks, you should be sure that key is hard to obtain and use by anyone unauthorized to use it.
And as a 11 year Steam user, I remember the early days where securing your account was a nightmare. Before the extra protections, I had to recover my account almost once a year. Some friends about monthly. Steam accounts are a high traffic target. In the end, this just doesn't affect Steam users, but Valve as well. I would imagine they have lost a lot of money just correcting and incurring the costs due to these issues.
So, overall, I don't think their security practices are the result of a single reason.
You have a different definition of security than me,
Steam isn't even remotely secure. Every app installed gets full access to your entire system. You have no idea of any game is installing a root kit or a key logger. You have no idea what data they are reading out of your system and uploading to their servers. As far as you know when you installed game ABC it uploaded the entire contents of your user folder and your download folder, stole your steam password then logged in and sold your credit card info.
If Steam was truly serious about security they'd implement a sandbox similar to Chrome or the Windows App store or the Mac App store or Android or iOS such that the games they distribute can not access your system.
The security you mention only has to do with the login for steam itself from people not on your system. Which, while all their measures seem to make things more secure the fact that any steam installed game could steal that info makes it actually fairly insecure, especially now that they ship so many games. Apple (iOS or Mac App store), Microsoft (Windows App store) only allow apps that live in their sandboxes to prevent this kind of stuff. Android and iOS force all apps to live in sandboxes. Steam has no sandbox
One thing that the other answers don't mention is how fraud affects the banks versus steam. If a bank account gets frauded they return the money and that's about that. They might lose customers, maybe.
On, the other hand, if a vendor (steam) in this case gets frauded too often, or have too many chargebacks against them, credit card companies will blacklist them. If steam can't accept any credit cards anymore, they are done as a company.
I am not saying this is 100% why but it should be a good indicator on how important their security really is. I have had my primary email account leaked in that mass gmail hack a few years ago. The first things the "hackers" attempted to go after was my Steam and Netflix accounts. I also got failed login attempts for just about every other gaming network I had ever signed up for. If they did not have such good security someone could have easily gotten into my account and gifted themselves thousands of dollars in games. My bank would have not warned me because I am a game collector so it would have been detected as usual spending more than likely. I am glad they keep that puppy on lock down, having been the victim of identity theft in multiple forms I now only feel comfortable with sites that require 2nd factor authentication.
ps. To this day you can still find my gmail credentials on the internet.. they have been passed out everywhere. It was a wake up call, I had to change my password for so many sites it was sickening but I am a lot more careful now and use unique passwords on just about every site.
