I wouldn't call it "shenanigans" unless there were ever a case of Mint making any change to a user's account. So far none. They're clearly not trying to trick people into giving up credentials for nefarious purposes.
It's kinda like when Dropbox said they couldn't access user's files even though they technically could.
(Too late to edit)
Also, many banks have a way to alert users to logins from new machines and many have things like 2-factor authentication and security questions which would make it hard for a criminal to use my credentials if they were somehow swiped from Mint.