One issue is that some classes of users and locations (e.g. Trading floors) are restricted by law concerning the communications systems they can use for work because all communications regarding financial transactions has to be auditable.
On the other hand most of the banks have their own internal software libraries you can install stuff from and you get a bunch of useful utilities by default such as Irfanview, notepad++, Greenshot or similar. Machines for devs are often less locked down.
Hence the popularity of portable apps which don't use installers. The just unzip to any folder and run.
Once a portable app shows up in the reports you are simply fired by blatant disregard for the rules and procedures you agreed to when signing your contract.
Finance is a heavily regulated environment and you can't get away with things that would be excusable in other places.
That seems to be a rather extreme clause; I doubt that a bank would care if a developer installed something that was not whitelisted. It would be a different story if the developer linked against code whose source was not easily attributable.
But a long way from MS Paint.
In brief, if any of the said applications require Registry entry, it denies that through the permission model that these systems have installed.
If it requires altering some files under some directory, it denies that as well.
Some corporations even restrict such shady websites altogether using an exhaustive list of restricted domains and subdomains, often maintained by a third party, who do this list maintenance full-time for corporates like IBM, TCS, just to name a few.
On top of it, almost all network and device activities are tracked, flash drive ports disabled, etc. to ensure "security".
(Only a handful of underpaid device managers have access to Admin account. Forget the fact that this still doesn't prevent them from doing so at their discretion, or credentials sharing)