Even further, is it not a violation of the TOS of those services to disclose the password to a third party?

Edit: I just saw that it says your connection is read-only. How does that work if you're using the same password? Do you have a special deal with the brokerages that allows you to ask for the password and that they don't allow any login from your domain to change anything?