No, it's not really a surprise when you step back and think about it—the core purpose of cryptocurrencies is to provide for immutable, "trustless" transactions

No, it's not really a surprise when you step back and think about it—the core purpose of cryptocurrencies is to provide for immutable, "trustless" transactions that cannot be refunded or disputed. Instead, these transactions are based only on technical constructs (passwords, private keys), rather than social constructs (signatures, invoices, remittances). Additionally, the internal controls that are designed to prevent one rogue employee from doing anything are much more extensive and mature in the finance industry, since it's had longer to develop them and doesn't have to rely on purely "automatic" technical factors. "Compromising" a traditional finance employee's account might be embarrassing for their employer, and may result in the leaking of trade secrets or other sensitive information, but the actual financial loss is going to be very minimal.