At a large bank like this, the people responsible for cybersecurity have a completely separate reporting chain and incentives than the ibanking side. If there was a security risk identified, it'd be completely inappropriate to wait a few weeks.