The same-origin policy helps protect sites that use authenticated sessions.
The user visiting the malicious site would expect that the site he or she is visiting has no access to the banking session cookie.