With computer security, you have to obsess over the minutia because a single vulnerability is all it takes to defeat the system.
I'd say that more than obsessing over the minutia, you have to obsess over the entirety of the system as used in practice, of which the authentication system is only a small part. I don't know finance that well so I'm kinda spitballing here, but stuff like exactly how the system that approves transactions actually communicates with the systems authorized to actually move money, what types of transactions are allowed and to where, what kind of checking is done against various transaction types, how to correlate to the user's activity history. If user normally connects from Atlanta and uses an online billpay system to send checks to a handful of companies, be very suspicious and probably flag and review the transaction if somebody suddenly logs in from a different address and requests a wire transaction to a foreign bank, etc.
The evidence (lack of constant ripoffs) suggests that they are quite good indeed at obsessing over the minutia of the rest of the system. This allows them to get away with authentication practices that are, depending on your point of view, somewhere between actively awful and bending over well past backwards to make things simpler and less error-prone for unsophisticated users. Got any idea how many users with 7-figure or more account balances still want to login on their flip-phones, bank online with IE6 on WinXP, use their account even after they epically screw up their password or their TFA key, etc? Neither do I, but I bet it's a lot higher than any of us would like.