I'd say surely banks will use this for their online banking systems.

Then I wonder, because of some of the delightful vulnerabilities I've heard about.

So I'll just say banks certainly should use Strict SameSite cookies, and in fact they seem designed to suit banking workloads (especially as banks don't usually offer persistent logins, because that's too dangerous).