They do use Yodlee but you still raise some interesting questions. Should the bank really be allowing access by a third party using stored two-factor credentials?