On: I didn't get paid, so I open-sourced my client’s project

[tekknik]

Plaid doesn’t let you transfer any money through their API, just read data. If Plaid gets compromised and your username and pass get leaked and used then most (all?) will detect the location change and confirm via SMS.