As others have pointed out, Plaid is service that lets people interface with your bank via one API, the Plaid API, Plaid deals with all the various banks. And Plaid mines your account advertising (as it says in their TOS/Privacy policy) and shares that info with whoever they want.
I also found out (and this is old info) that ANYONE can take money from your bank account without your permission. There might be repercussions for them later or maybe the bank has to trust them but I found this out because I signed up for Apple Pay and Apple Pay wants me to pay my bill via ACH.
https://en.wikipedia.org/wiki/Automated_clearing_house
What happened is I gave Apple my info (routing number and account number) and without the bank confirming with me that Apple had permission to take some money, Apple sucked money out of my bank account.
That's crazy to me. Those 2 numbers are on every check I've ever written.
I get that someone can charge money to me with my Credit Card info but AFAIK if it's fraud I'm only out max $50. Plus, it's not my money, it's the CCard company's money since it's effectively a loan and the fraud is their problem, not mine.
I'm sure someone with more knowledge can tell me why the ACH system is safe but I find it super scary ATM.