It is required so that an external site can post on your behalf. Steemit.com asks your password for the same reason. Right now, there is no other way for external sites to make any actions with your account without the posting key. It is a common practice used by almost every other site that expands on the steemit medium.

From steemfollowers site: "You will Login with Steemconnect, we never store your information on server or on your browser. So, hacking your account by this site is impossible."