Agreed on both counts! The danger is inherent to any unofficial Robinhood integration since they don't provide OAuth. We've tried to be upfront about the tradeoffs in our security model docs.