> Also banks are more likely to take basic security seriously and not leave core services open to the public internet

You'd think so but I've seen banks leave compromised systems on their network for months after they were notified about them, including ones being used in botnets. One bank had even been temporarily disconnected by their ISP to stop the spam/hacking leaving their network, but they said they didn't care because it was just their backup connection in case their other ISP went down.