I work for a very large bank, we secure our sensitive communications with PGP. Part of my job involves communicating sensitive information with other very large banks which also take encryption seriously. I suspect that the bank in the article is the exception, rather than the rule.