Yeah I was worried about this too, it's a disturbing trend.
Venmo was asking for my bank password a couple months ago, I was like fuck no. Who the HELL does that. Should be illegal to even ask.
https://twitter.com/simonw/status/1479174549266526209
Short version: OAuth for banks is finally starting to happen, but in the meantime the password anti-pattern fills the gap.
Doubly fuck no.
Venmo could also get the credentials if they want to, since they're launching it from within their own app. They could keylog everything in their app if they wanted to, including what happens inside Plaid.
Nobody should ask for passwords to anything but their own service. Period.
Asking for bank passwords should be made illegal. If I were the president I would have made that a federal law yesterday.
Plaid provides a useful service that's a stop gap for the poor infrastructure of banks. I honestly doubt that most banks would have even bothered to start the laborious process of OAuth without them being an extremely popular middle layer for services like YNAB. My company actually uses them to process recurring payments.
Plaid is not useful if they need to ask for passwords.
That doesn't mean you should trust them (I don't), but just because you haven't heard of them doesn't mean they're not big.