Please correct me if I’m wrong, but I believe Plaid uses an OAuth-Luke experience via an external tab/window to an encrypted sub domain of their website for authentication (so no middle man sniffing technically possible).

Disclaimer: I do not work for Plaid, but have used it in the past.