I assume it requires credentials for each platform, so it doesn't enable anything that they wouldn't already have access to if they could log in to every single one of your accounts.
It requires credentials, but with a standard format/protocol it means extraction is easier for someone who might happen to acquire such credentials with nefarious intent.