It's been normalized. Even banks that explicitly prohibit user/pw sharing with external tools in their ToS (every one of them basically), will often have aggre

It's been normalized. Even banks that explicitly prohibit user/pw sharing with external tools in their ToS (every one of them basically), will often have aggregation features in their portals that require you to enter the user/pw for the external accounts you want to connect. They might even have back-end API's that allow other aggregators programmatic access to your data, that require your user/pw to auth. But don't share your user/pw with anyone, they say!