Having worked at various places, I think financial institutions are actually very rigorous when it comes to testing and fixing bugs. It has little to do with whether they're still running COBOL or not.

These cyberattacks are going after systems that barely even needed to exist in the first place, so of course they're insecure. In my opinion, this is a correction that was decades overdue. Either take your software seriously or don't bother at all. I'm surprised it took this long.