For problem 2, I imagine that most financial institutions have pretty damn good security probably almost equaling government security agencies, considering 1. The amount of money they have, 2. Already under constant attack by cyber-criminals.
I also imagine that the security at utility (power, water) or transportation (airline, bus, etc) companies is pretty pathetic. That's where they should be focusing.
Most financials do have relatively good security; unfortunately, that's "good" relative to the baseline of "incredibly terrible". It's hard to think of any large organization connected to the Internet that has a security program you could objectively call "credible".
I also imagine that the security at utility (power, water) or transportation (airline, bus, etc) companies is pretty pathetic. That's where they should be focusing.