This is even more important because banking systems with legacy password limitations (e.g. 8 characters) generally imply that there's also legacy password manag

This is even more important because banking systems with legacy password limitations (e.g. 8 characters) generally imply that there's also legacy password management - meaning that it's very possible the approach to hashing is outdated. bcrypt or scrypt is a best practice but it's far from universal in brand new software, the systems these banks are using were likely developed before either algorithm was published. I'm even ignoring here that many banks at least recently used to provide strong hints that they are storing passwords in plaintext, such as by using a modified form of the password as a telephone passphrase.