Here is another good example of issues you may run into with security:
https://www.reddit.com/r/healthIT/comments/1s1vm3v/i_built_an_opensource_connector_between_mychart/
The original post has been deleted but the comments summarize a lot of the reasons the OP deleted it, and you can still find lots of discussion and a git repository if you scroll through the comments.
Lots of the red flags you mention show up. For example, having OpenClaw read a user’s entire email to find 2FA codes. This is both questionable in the sense that you are giving unfettered access to your email and in the sense that it is kinda violating the entire purpose of MFA codes to begin with.
Disclaimer: I read lots of comments about this project (on that reddit post and elsewhere, where I first heard about it) but I did not look through the github page to verify if the criticisms were all true. It is possible people misrepresented how bad it is.