iOS app submission - access to username/password

App Store Review Guidelines necessitates this. You will be rejected if the app requires login and you do not provide credentials.

Before you submit:

• Provide an active demo account and login information, plus any other hardware or resources that might be needed to review your app (e.g. login credentials or a sample QR code).

2.1 App Completeness

… Make sure your app has been tested on-device for bugs and stability before you submit it, and include demo account info (and turn on your back-end service!) if your app includes a login. …

Also, how does your security team ensure that your first two users won’t see each other’s data? If adding a third account for Apple breaks your security, you’ve got your research can be concluded with the answer: the back end team is not ready to ship.

Is it the case that Apple requires to be able to login to review?

Yes. If your app requires a login to access all the functionality, Apple requires you to provide one, so that they can review the app in its entirely. Absence of login information may prevent Apple from reviewing the app in its entirely.

If so, how do people with financial/banking apps manage this?

Ask your software development team with a dummy/demo account with placeholder data. This should let the review team at Apple review the app UI and functionality to make sure they are in compliance with the guidelines.

We cannot really create dummy users as this will skew our stats and as mentioned before, our security team do not like it

Only likely way to move ahead at this point would be to request the IT/security/software development team to set up an exception, so that the review team at Apple can do their job.