Why would insurance companies care? These banks never have to take significant losses for their incompetence. If they were fined 1% of profit every time they were hacked, then I could see all sorts of mitigations being considered.