Yeah unfortunately this is the case with GDAX too. Made me uncomfortable too. I changed my password beforehand, entered it in GDAX / Gemini and then changed (within seconds) the password back to my original password just to be safe. The reality is they don't store your data and only need to do it once to verify your bank. It's safe, but I don't blame your paranoia.