Nobody is excusing him but it’s possible for multiple people to make very bad decisions as part of the same problem. In this case, the bank has almost certainly claimed to have security policies in place which would have prevented any of the damages in question. I don’t even work in banking but “how do you deactivate accounts when someone leaves?” is in every single system’s approval process and ongoing audits.

Think of it as if he had stolen money from them after being fired: there’s no question that the culpability would be his but also regulators and insurance would descend on the bank’s management asking why they lacked such basic internal controls for such very well-known risks. Most places will remove all forms of access as soon as the decision is made to fire someone because it’s the most likely time to have anything from theft to, in the US, a workplace shooting.