Typically management at financial institutions see "security reasons" as a quick way to end questioning from a customer.

Legacy software or partner integration requirements are almost always the reason for arbitrary changes within financial institution.

Anecdotally, I've never seen a scenario myself where this wasn't referred to as a "security measure" or similar. This includes within the institution to all non-technical employees.

They had good reasons to enact security measures as I was trying to get into my account internationally and I kept forgetting the password. I understand what you're saying though.

Makes me wonder if they didn't have any other way to disable logging in to the account. Which is worrying in a whole other way.