Tech companies should understand the risks with banks the same way banks need to understand tech risks. If a bank got ransomwared because they left the password to their webserver root/root no one in tech would ask "what did they do wrong?".