Because bank's principal job has been running ATMs for 40 or 50 years and it is run-the-bank stuff. If you look at internet banking (and how out of date and clumbsy most of these systems are) you will see this effect. Change-the-bank stuff is what "suffers" from this.

Retail banks' ATM and overnight payments systems are often 25-year-old pieces of software and hardware.

Multi-party controls and generally complex technical controls add minimal overhead relative to benefit in large organizations working on static systems; they're horrible in small companies working on rapidly changing products. (Imagine a tiny startup where you have a 4 week change control process for every modification...)