Many canaries are avoidable if you pay perfect attention - but people slip up, and even if they don't, paying perfect attention does increase the cost for the attacker. (And e.g. throwing out all Amex corporate credit cards (one example of the "banks" they use) as you suggest does reduce the value of stolen data too)