Patrick, I think you're giving banks much more credit than they deserve. They are slow-moving monoliths that only respond to security issues when their profits noticeably drop.

Edit: And that's probably a smart tactic, as they aren't getting sidetracked from their primary mission of generating revenue.