It looks like the credentials in credentials.json are your Plaid access key/secret/etc, not your bank account username/password. If an attacker gets them, they'd have read-only access to your bank account until you rotate your Plaid creds, but they wouldn't be able to do anything as simple as logging into your bank account and transferring all your money out.

EDIT: It's actually worse than that, see comment from erichurkman below.