Why did finance administration F decide to virtualise the clients (step 2) instead of simply replacing its finance system?

The communication protocols and techniques no longer met current security standards, but the central finance system could not be replaced quickly. The weak points were the insecure communication protocol between client and cluster, the legacy server software and the legacy client software on every office PC.

* All three weak points sit on the path between the office PC and the cluster. *

This is the typical situation of a legacy system: it still does its job and the business depends on it, but it was built for an earlier threat environment and cannot be rebuilt on short notice. When the system itself cannot be made secure, the architecture has to make its weaknesses unreachable instead. Virtualisation does that: the insecure protocol and the old client software are pulled back into the data centre, where they are no longer exposed to the office network.

Go deeper:

• Legacy system — Wikipedia — why old systems stay in service and what that costs in security.
• Desktop virtualization — Wikipedia — running the user's desktop centrally and only showing it remotely.