1a: I don't use plaid, but I suspect that adding the plaid domain to valid domains for your bank's passwords might work. I consider any time I need to copy/paste to be a big issue because it significantly increases the chances of successful phishing.

1b: yes desktop app seems like an afterthought

2: This is annoying and should be fixed. I didn't think of it because I so rarely register for new websites.