The attack surface on software the size and complexity of a bank's is like the Death Star, except any single rivet being out of place will eventually result in this headline.
I agree that banking software is probably complicated. But really, this bug is a beginners mistake and it shoul dhave never happened.
It is something that the original developers should have known about and also something that the company auditing this code should have seen.
There is really no excuse for this.