You are not giving TabTrader any credentials to your actual account (even so, there's also additional 2FA), but only API keys.
*YOU* can define, what "levels" you are binding to APIs, so if you define, that key "1" has ability only to read balances, then actually TabTrader cannot do anything else...