That's why it's not surprising at all that a bank didn't bother to do that. Banks have some of the most egregious security issues.

And really shitty auditors apparently. A good one would have at least spot checked for unsecured ports.