Which gateway functions does the SAP router fulfil at the financial institution, and what risk does that create?

It makes the whole SAP landscape of many servers reachable under a single IP address on the internet, enables remote maintenance by the vendor's support, serves the external SAP consultants for remote work, and is used for data exchange. As a gateway it opens not only a door in the perimeter but, specifically, direct access to the SAP systems, including the finance system.

It is a classic multi-purpose gateway: address aggregation, remote access and data transfer in one box. That makes it a single point that, if misconfigured or vulnerable, leads straight to the most sensitive systems of a financial institution.

Go deeper:

• MITRE ATT&CK T1133 — External Remote Services — remote-access gateways as an attacker's way in.
• Attack surface — Wikipedia — why every extra passage and legacy part enlarges what can be attacked.