I've been playing around with Plaid the past few days and they very clearly list the permissions during authentication:

https://i.imgur.com/xNPTIzy.png

They even link to a dashboard that displays all the information you are sharing with developers:

https://my-sandbox.plaid.com/account

That said, I agree that the average user won't realize the implications. Additionally, revocation/deletion of the data requires emailing them.