You've correctly realised that you want to keep the attack surface as small as possible by limiting the services that can connect to your investment accounts.

You've correctly realised that you want to keep the attack surface as small as possible by limiting the services that can connect to your investment accounts. Given this constraint the easiest way is a spreadsheet that you update manually. Thinking about it, if your portfolio was fairly simple you could write a script that calls the yahoo finance, zoopla and binance APIs every week or so to see the progress of your investments. You then manually change the script whenever you make an unscheduled trade, or get charged fees. The script knows how many units of each asset you have, but it's not a security risk because it doesn't connect directly to any of your accounts.