Well, in the case of Wealthfront (which is what the tool was originally posted as the workaround for), the generated password that you need to paste is only valid for TurboTax, and can immediately be revoked, so there's basically zero exposure.
Using it for a brokerage login, you could have a valid point, but that would assume that the app is also able to access your login userid, which it's not clear that it can.
Also, the source code is available.
