> It's a giant security risk that neither company would likely cover if someone got a hold of your login details.

Sure, but it shouldn't be the bank's decision to keep me from accessing my own customer data because it's insecure.

If they actually wanted to fix this, it would be entirely possible to provide a read-only API.