+1. Bad reporting here. This seems to be mostly about consumer disclosure, not that what's happening under-the-hood is different that what your average security-conscious developer might expect after reading that Plaid doesn't sell your data.

That said I think the suit makes a compelling argument that the disclosures should be better.