Given that for other ACH transfers I'm able to just hand out my routing+account number and that's all that is necessary to complete the transfer. The fact that companies are training people to input their bank username/password on other websites is completely insane, even if some might know to change it afterwards. If a scammy website did this, I'm willing to bet you money they'll change that password faster than you ever could.