Mint and others used to (still do? I haven't used any of these things in over a decade) take your username/password and sometimes even security questions and then use screen scraping to get transactions and balances and such. This was (is?) because many banks and CC companies didn't have proper APIs or access tokens that could offer limited access. The result was that Mint and others could, in theory, initiate transactions as you.
Naturally, banks and others said, "Don't do that, and if you do you're going to lose some of your protections because you're willfully giving away your credentials."
