Please correct me if I'm wrong, but I vaguely recalled Plaid actually directed me to my bank's webpage and asked me to input my username and password. So it seemed to me that it's similar to those "log in via your Google/Facebook/etc account" third-party authentication service.

Are you certain that the password/text auth code are sent to Plaid instead of the bank?