How come Apple knows all my bank passwords?!!!

I’ll give it a try. Apple does not know any of your passwords. Your PHONE, which you own and only you can access, knows your passwords so it can fill them in when you open apps. If you don’t want this feature, turn off Keychain.

YOUR PHONE has access to lists of passwords that have been compromised in data leaks. YOUR PHONE (not Apple) compares your passwords that you saved in Keychain to the compromised password list, and tells you about any of your passwords that match passwords that are on the compromised list, and that are thus available on the dark web to criminals.

You can also check your passwords against a compromised password list (not the one that Apple uses) by going to https://haveibeenpwned.com.

Check Settings > Passwords > Security Recommendations and carefully read the “About Passwords & Privacy” link near the top there.

If you are using a bank app, check with the folks supporting that bank app. Apps can store data in Keychain.

If you are using the bank’s website, Safari can (optionally) save the credentials into Keychain.

And if you are seeing warnings about passwords and irrespective of where that data was acquired within your keychain, the passwords involved are weak, or were previously breached, and/or were re-used.

Apple doesn’t have your passwords. Your iPhone Keychain, or iCloud Keychain, has your (saved) passwords. And given your comments here, I’m going to assume you’re not using iCloud for backups, and which is where Apple might gain access to your data.

Your device can have your passwords saved in Keychain, as is common. But Apple doesn't know your bank passwords.

If you're looking at the password recommendations, those passwords have been exposed through any of various paths, or were weak choices, with the details described in the various entries.

If they are all listed there then you saved them there.

Settings > Passwords show the passwords you have saved.

Passwords shown in the Password Recommendations list were saved by you, and were weak, or exposed, or re-used, or otherwise problematic password choices.