I have the same experience. But they are usually not willing to invest until they are hacked and even then. It is like the article yesterday on HN ; correctness & security are nice, but almost always not in the budget. Even when the result could be far larger losses. It is the 'could be' that prevents almost the entire world from doing something about it as for most systems it doesn't happen even though it very easily could happen at any time. Like the example from this blogpost.

Seconded.

Actually, as a bank, you only need to be slightly more secure than your competitors.

Moreover, you will never need to be unbreachable; many times I have seen banks not fixing vulnerabilities, simply because these vulnerabilities were not profitable enough for attackers to exploit.