I suspect it's a game theory situation - until banks are unilaterally made responsible at once (say by a new law) - none want to be the ones to make their workflows more complex and invest in better ways to remotely authenticate an identity.