At least some of the information is on-chain and can be verified.

Actually it isn’t. What is on chain is custom Json messages that cannot be trusted. Think of them as withdrawal or deposit slips. You can ask to withdraw $1M and fill out a slip but it doesn’t matter if your account doesn’t have the balance.