Am I too paranoid about bank security?

It seems that some smaller banks still follow outdated security practices. Is that a problem or am I just crazy.

My current bank doesn't seem to support SSO. Their mechanism for linking to external services is to have you store your username and password in the other service and then manually enter the MFA code on each sync.

My previous bank still had an archaic system that required regular password rotation, had weird "complexity requirements" but still wouldn't accept all the "special characters" from a password generated by a pw-manager.

Are these things actually no big deal or are we just waiting on a wave of crime against small banks?