Shit security practices are, unfortunately, extremely common in the consumer banking industry - they tend to be very conservative about abandoning outdated practices - but this doesn't actually seem to be an example of that, so much as a blind "more must be better" approach.