"I'd assume that for banks all code that goes into production gets audited" The point of tag managers is to let non-developers update production without going

"I'd assume that for banks all code that goes into production gets audited" The point of tag managers is to let non-developers update production without going through a code deployment so the usual code review and oversight doesn't apply. Also worth keeping in mind that this is the bank's marketing site. It's almost surely managed by a different team than the actual online banking site and probably has looser restrictions.