The exact scenario in my mind is that a bank is letting the customers download its mobile banking app via its website over http
The most simplified answer is that "mobile banking app"s aren't downloaded over HTTP. If there is an answer that is more specific, we are probably missing critical details about the workings of your relatively unknown bank and mobile OS.
The most popular mobile phone OS's use central app stores, where apps are supposedly vetted. (The app store downloads are authenticated. They happen to use HTTPS, which provides privacy as well).
Android may technically support downloading apps from a HTTP website. However, doing so will show warnings so scary that a bank SHOULD NOT do this.
Downloading executables over HTTP is mostly an old Windows ("PC") thing.
How probable is it to have a MITM scenario ...
It might be less than you think, from how security people talk. Unfortunately, it is more than is comfortable. One problem has been vulnerabilities in consumer/small business routers. The attacker doesn't need to install sophisticated code, just configure the router to use their DNS server.
... where the client goes about downloading a specific executable?
I think it is relatively infrequent that you have to manually download an executable - compared with other things you can attack with the MITM.
It wouldn't be very profitable to attack a specific executable. Most likely all executables would be attacked. Example. Thanks to Nasrus' comment for the excellent link. The linked example suggests this is more likely in some countries than others.
Notice that one obstacle is code-signing. Windows will warn you on "first-run" / running downloaded software. Without a code signature, the warning is relatively scary. With a signature, the warning will show a company name. For example, the certificate authority might be slightly cautious about issuing certificates with a company name "Micro-soft" or "Barclays Banking". And the user might be suspicious, if any executable they download warns that it is from "Simon's Honest Software", and not anyone they expected.
Code signing helps against more common attacks than MITM. I think it helps explain why you used to see a lot of Windows software downloaded over HTTP, and you didn't hear a lot about this being exploited.
The websites that serve files over https, can it be considered overkill? or is it a best practice everyone has to follow?
The Web browsers tell you HTTPS is good, and are pushing for it to be the default. I generally agree. I don't know if they have any warning on HTTP downloads yet? E.g. it's possible they would start warning if a HTTPS page links to a HTTP download, so they can get a little extra leverage from the padlock in the address bar.