The bank told a security expert “sorry you feel this way” when a potential vulnerability was found.