I note any person could have reported this issue , by sending a few anonymous messages to several relevant people - starting with senior people and mentioning their responsibility's and casually mentioning a few facts that only a limited number internal people likely to know etc .... And if nothing happened "in a while" , send information to a wider circle of people
As A Software test alysist for 20 Years, working in a company that was "bank like", where numerous transactions could involve large sums of money. When software changes where ready to go to production, There would be a audit of the testing. This would take at least a few DAYSs. The (government) customer would hire independent very experienced software engineers / testers. We would have a test system that mimicked the distributed production system. with all (100s) of software versions matching . We also had internal and external auditors .
Our test plans . test cases , test data and test results would be examined. Some tests would need to be reproduced in the presence of a auditor. Or the auditor would ask for tests to be run using their provided data. We also had load testing, deployment testing, rollback tests etc. The software had to conform to certain international standards for security - so such remote access would not have been possible, in our case. If it had existed it would have been discovered through audits . Other measure s where taken in system , such as encrypted of messages and encrypted databases . Access was tightly controlled . Software developers could not deploy to prod. Lots other security controls to