That's insane. If anybody told me to send them my bank account number and routing number, I'd assume they're a scammer.
It is completely understandable that someone like you who doesn't live or work in the USA wouldn't know how sensitive a Bank Account/Routing number is here. If you exist in a modern banking system with proper security, it is easy to assume that the rest of the world works the same way.
However, there is absolutely no excuse for the decision makers at Spotify here in the USA not to understand this.