At the very least one would expect the bank to be salting and hashing - PrivacyDotCom presumably has to keep the plaintext in some form in order to use them!

As a secondary concern, the bank has occasional 2fa, and definitely does some kind of anomaly detection. Primed by the ickiness of the user/pass request I just had a mental image of some hacky Selenium script on an AWS IP address filling out the login form and getting my online banking disabled proactively.