Is that even within Paypal's TOS? Can you front-end their web service and capture users' passwords purportedly for proxying?

I know that Sofort does that and I'm flabbergasted by my bank switching their stance from "wait, who's capturing our login tokens?" to "oh, you're talking about Sofort. Yeah, we can't control what others do on the internet [I mentioned they could just block the Sofort servers]. This is fine." Checking back what the official statement was, in summary it came down to that (use of) Sofort doesn't comply with the TOS but they're currently allowing me to use it until they came to a more permanent agreement in current talks with Sofort.