Regrettably, quite a few sites like banks, insurance companies, etc., not only use Flash but won't function without it (or at least function in a way where you can see what is going on). Believe me, I constantly try.
Now, you would think companies like banks and insurance companies would be very security conscious, and aware of the burden that maintaining secure versions of Flash (and Java!) places on ordinary users, wouldn't you?
Exactly why I would dump a bank who uses Flash for critical parts of mobile banking.