Same reason why media companies spend millions on DRM that delays the pirates by 0 days. Checklist-driven "security", CYA and out of touch executives calling the shots.

Did the higher ups want more effort to be spent on "security"? Yes. Is there any way to actually add "more security" to the setup? No. Could not doing anything in face of direct orders from the above be bad for your career? Yes. So random bullshit go.

It's not like the bank client developers are even implementing any of it themselves. They buy someone else's middleware and hopefully don't misconfigure it when they cram it into their builds.