Not only risk aversion - they were really early in digitizing their baseline services, so many of them have quite old mainframes by now. It's difficult, expensive, and, as you said, risky, to change old code that the whole organization is operating against.