Banks and investment firms face mounting exposure as ransomware incidents jump and more than half of vendors carry high-severity flaws.