As someone that penetration tests a lot of banks it does sometimes make it's way through. Larger and more established banks (at least in EMEA) sometimes tend to use highly distributed systems that all interoperate in very strange ways, which can sometimes lead to interesting results on web application penetration tests (e.g. there's no data store, so no SQL injection but there'll be some obscure pre-relational data store you can inject right into if you only know how to talk to it).

It's not that easy to get rid of either, the banks have to support internal applications that expect things in those formats, as well as all the unofficial apps that plug in via messaging systems and may not be aware of the other app from either end.