It'll use app-specific passwords or OAuth with banks that support that, and both of those can be secured well enough.