Plaid has OAuth-based access for most of the big institutions now, but yes, for smaller institutions, they do scraping. Thankfully, Plaid's been around for a while now and has a good track record. It would be a non-starter to give your credentials to a small startup directly.

the question isn't whether the user is trusting Plaid with too much access, the question is whether Plaid is trusting these apps with too much.

I am the kind of geek who doesn't even want a second record of their finances around. My physical bank statements even have a procedure for how long they live until being shredded.

If I were interested in this though, yea, a local LLM would be the only way.