Seems funny though that the goal of "keeping money protected" is something that the banks want to drag their heels about since they might have to pay for it... On the other hand, "you get what you pay for" seems to apply when they are shopping around for the cheapest devs they can find.

Wouldn't shoring up holes in security ultimately reduce costs though - safes cost money but banks still recognise the benefit of putting them in, and they don't just buy the cheapest one available.

I don't think this simplistic "it's a cost centre" gets to the heart of why banks are seemingly so bad at online security.

If Finland is anything like Denmark, not enough money is probably not the issue. Bank IT is a pretty well-paid job here, near the top of the scale for programmers. But nonetheless has a reputation for being poorly run and just somewhat boring, with a workplace dominated by "suits". In fact you might have to actually wear a suit to work yourself. So it attracts people who want a stable job with no overtime and a large paycheck, and are willing to put up with high management overhead and banking-sector culture.