Its up to the bandit Who he wishes to attack, the merchant has given his consent by logging in.
that said murders should live a life of uncomfort like Being "restricted" to lawless towns. The game shouldnt protect the player, the player should protect him self or hire bodyguards.