If it ain’t broke (in a way that affects the bottom line), don’t put yer hamgrabbers anywhere near it.

but it is broken, utf8 support need wasn't new when the law suite happened

there is also the issue that I would be surprised if that system _didn't_ had tons of security vulnerabilities (which just weren't found because of it's obscurity). Heck, I have heard of enough cases where old banking systems had ton's of well known security issues in their interface they just "defined away" by means like "oh you need to be a bank employee to abuse them so they are not an issue" or "pst, don't speak about it we (supposedly) can't afford an update and they would fire people if they need to do an update".

They were already upgrading their systems when the lawsuit happened. That's why they didn't fix it: "not worth it since we'll be replacing it all".

And ING's Unite be+nl project didn't end up meeting the dates they provided the court, so even if the court had accepted that excuse (it didn't), they still would've needed to alter their systems anyway. In fact, the attempt to unite the Dutch bank with their Belgian counterpart, which would've modernised the system, was cancelled in 2020 after barely making progress after four years, followed by a thousand jobs being cut worldwide.

"We're going to replace this anyway" is a pretty bad excuse for a fix that should've been completed ten years ago, and with the replacement clearly not coming any time soon, especially when the you're legally obligated to provide the fix.