One way to deal with this is when a streamer wants to connect their game have Twitch generate a cryptographic nonce. The player will then enter the nonce into the game client which uses that to establish the connection. The nonce should only grant limited access to the account, and certainly not the privilege of changing the player's Twitch password. In this way the game client only has access to limited portions of the account during each session.