[gardarh]

They might be running AS/400 as their backend systems, I recently saw a terminal to one of those in a bank and to my shocking surprise the passwords were not even encrypted on that system.

I imagine that passwords are kept in the same database as transactions so I'm not sure the passwords would be the primary concern in the case of a break in.

[bencoder]

The frontend part can still use a secure password mechanism which is then hashed to a password suitable for the underlying backend system.

There's no reason to keep the bad decisions from decades ago as a part of a modern system, even if it relies on the legacy system.