There is no guarantee that anything specified on a whiteboard will actually make it into physical code, particularly if it's handed down from on high. Banking websites are terrible not because they use TDD, but precisely because of the supposition that a good architect and a whiteboard is enough safeguard to skip them.

Tests make it possible to refactor your code towards simplicity and clarity, making security errors more clear. If you're writing a banking application, ignoring them is simply foolhardy.