Anecdote from third world country here. Friend works in 'IT security company', told me banks are the worst here.

One bank had guys in the IT department work for a couple of months then quit, one after the other, apparetly after having stolen 'enough' money (whatever that means to a thief). Rinse and repeat, till their company got called in. That bank's systems were apparently that bad.

I always wondered whether it was that the bank had no proof of the theft or an image thing where they could not afford to go after them because customers would lose confidence in them.

I once worked for a bank and I recall they had a policy not to bother chasing after any fraud below a (surprisingly high to me) dollar figure, except if it was suspected that an employee was involved. If there was suspicion that an employee was involved, then they would go all out even for the smallest amount.