They can make stuff up, right? They are allowed to say "we are keeping your money for 120 days because of some security ...". Who is ever going to know this is valid/true or not, unless it goes to trial somehow and there is a lot of discovery done.

They are literally funding themselves out of deposits, in a small way if they keep any persons money for any period of time. If they start doing it to lots of people for months at a time then they are at least partially funding themselves from their customers.

Lots of businesses do this incidentally. A good one is businesses selling gift cards. It's not the same; but this set of conditions is not super uncommon.