I can't even say this is questionable, this is unacceptable. I can hardly believe this exists and wonder why is it allowed to. If I were a bank I would block any attempts to access an account (or even put the whole account in quarantine) if I had any suspicion it's someone else but it's owner is who is entering the password.

And the security itself is not my main concert, privacy is. A third party should not know what I do with my money.