Spotify is an European company. Here it's normal to send people your bank account number, you put it on invoices, on your company website, etc. I assume someone who invented this process assumed this is normal everywhere (I learned today that in USA it isn't).
Spotify Technology S.A. may be headquartered in Sweden, but all business in the USA is conducted via Spotify USA Inc, which is a US company headquartered in the World Trade Center in New York City.
It is completely understandable that someone like you who doesn't live or work in the USA wouldn't know how sensitive a Bank Account/Routing number is here. If you exist in a modern banking system with proper security, it is easy to assume that the rest of the world works the same way.
However, there is absolutely no excuse for the decision makers at Spotify here in the USA not to understand this.
