Am I totally misremembering this, or is it a fairly recent change?

I could've sworn several years ago it was perfectly possible to use your sign-in credentials, then immediately change them, because it basically needed an authorization token, but then worked fine.

Now it doesn't. I work for a company with a Plaid integration and if the bank so much as requires any kind of 2FA, you just can't use it at all anymore.

I work at Plaid. It all depends on the bank. Most data provided by Plaid is sent from banks to Plaid via API, but some isn’t. And generally Plaid connections work fine with 2fa, but some don’t depending on the 2fa method and implementation details.

I don’t know, but it almost certainly violates your bank’s terms of service to share your password with Plaid.

If Plaid is every compromised in a way that leads to a loss of your funds in your account (probably unlikely), your bank likely has no legal requirement to make you whole for that, if you shared your password with Plaid.

I just don’t think you should share your bank password with any external entity.

Very good point. Plaid will surely send you a $50 class action settlement check to make you whole for having $100k drained.

I'm not sure. It is possible that some banks have an API that Plaid uses, but this issue has been known for several years and discussed on here quite a bit. Plaid even had a large settlement due to privacy violations.