I don't think that is true with iframes, which is what plaid uses to allow users to enter their banking information. So plaid still can get all your keypresses

I don't think that is true with iframes, which is what plaid uses to allow users to enter their banking information. So plaid still can get all your keypresses but an app that uses plaid does not. To be clear you have to trust plaid, and you have verify that the web app is actually using an iframe and not just faking the plaid interface. But you are not just trusting a random web app with your banking credentials.