I'm going to have to disagree with your point about banking applications based on my experience (~15 years) in banking IT and security.

Whilst obviously Internet facing apps are treated with more caution, it's definitely not true in my experience to state that there are no security demands on internal applications. I would expect that most/all banks these days realise that there's no such thing as a fully trusted network...