No, it's not really a surprise when you step back and think about it—the core purpose of cryptocurrencies is to provide for immutable, "trustless" transactions that cannot be refunded or disputed. Instead, these transactions are based only on technical constructs (passwords, private keys), rather than social constructs (signatures, invoices, remittances). Additionally, the internal controls that are designed to prevent one rogue employee from doing anything are much more extensive and mature in the finance industry, since it's had longer to develop them and doesn't have to rely on purely "automatic" technical factors. "Compromising" a traditional finance employee's account might be embarrassing for their employer, and may result in the leaking of trade secrets or other sensitive information, but the actual financial loss is going to be very minimal.

My assumption is that traditional finance money is often a lot more refundable.

FWIW, different industry, but I did a few months as a contractor at two AAA game devs and my god the amount of shit you have to deal with, having a staff flagged forum account with 0 posts, people would go through the member list, send hundreds of DMs begging for free shit, try to find your email to harass you for free beta keys or cash shop items, friends IRL would be like "haha does that mean you can edit my character to be max level"