That's the nice thing about open banking is that now the banks are providing a read only API for 3rd parties that you've explicitly authorised the token for and can revoke at any time. Of course everything has potential security issues, but this is really more about privacy I think. You're sharing your financial transactions with that 3rd party. They have obligations under the open banking rules, but it's still an extra copy of your records sitting somewhere. But the upshot is potentially pretty big if you have multiple accounts, being able to see it all in one place.