I've done security testing for large banks and I can say that they do testing before rolling out updates. Even security updates from Microsoft are not pushed out without testing.

I would be surprised if they were affected.

And if they were, I'd be very interested in knowing how it got by them. It's possible they can't run their own update server like they do with Windows updates, or that they made an exception for security software updates (a policy they'd undoubtedly be reconsidering right now).

The only thing I can say for sure is that they do think about this and have processes and teams of people to mitigate it.