Given the pocketbooks of banks and the small footprint of such a secure embedded system, I think it won't be difficult to negotiate a contract with e.g. Red Hat

Given the pocketbooks of banks and the small footprint of such a secure embedded system, I think it won't be difficult to negotiate a contract with e.g. Red Hat to provide 20 years of support. The RHEL lifecycle is already 13 years, prolonging that to 20 years for a small subset isn't outside the realm of possibilities.