I mostly agree with your points, but "They are offering their services ALSO over the internet but not exclusively." is irrelevant. The attacks being discussed are not about the public-facing services but about their internal internet usage for interbank transactions and linking branches of the same bank.