But how many subsets would you do? With enough of them (and particularly relative to password length) this would leak a lot about your password. For say an 8 character password, do these things ask you to enter more than 4 characters?

On my >10 character passwords (I generally don't use shorter passwords with banking sites, so I don't know how the system behaves for short passwords) they ask for ~11 characters. Of course the login box can, and often ends up, being longer than your actual password, so it doesn't visually reveal the actual character count of your password. In my case they usually end up asking for ~5-7 "real" characters.

I presume a good implementation hashes and salts each "sub-password" separately. Since it's the server that decides which subset it wants, I don't think it reduces the search space, unless the hashing/salting algorithm is vulnerable to differential cryptanalysis (which it may be, I don't know this aspect of state-of-the-art hashing functions).

It's a huge detriment to security. You can break sets of 5-7 characters at a time and combine them instead of having to break the entire password at once.

Seems like a tradeoff. What's more likely - that a bank loses its password database, or that some customers find themselves infected with keyloggers?

Also in any bank that's even remotely sane this is just one leg of a 2FA; often a kind of a "delayed" 2FA - where one factor is enough to get you mostly "read-only" access, and any important changes or wiring actual money requires one-time SMS codes.

Any bank that's remotely sane with regards to website security (probably rather few of them) doesn't do this at all and uses standard forms of 2FA. This one doesn't even protect against keyloggers, because they can combine the characters from multiple logins to get the full password (guessing the remaining ones if necessary) and because the password might be reused somewhere else, and they try this at the expense of user convenience (counting characters is annoying) and security in the event of a leak involving password hashes (if they hashed them at all).

In today's environment? Probably the bank losing its password database.

I understand what you are saying, but I suspect that fb doesn't store multiple hashes but just recomputes the hash entered a couple of times on failure.