I wouldn't personally say it's a red flag, just perhaps not optimal. This is a real program that came from PG&E. Also, if you look a the page where you link your tesla, there's another way to connect your account that doesn't involve you giving them your password.