The thing that’s being missed here is that direct debits can be disputed in the same way a credit card payment can, and by default the customer wins. Their money will be refunded immediately by the bank, who will then go after you to get it back.
Yes and no. Swedish banks for example will just deny direct debits unless the customer has explicitly agreed to let their accounts be charged. So direct debit works differently per country and per bank.
Let's say I have account number 1234 and my name is John Doe.
You're telling me that, no strings attached, no repercussion, Mike Hacker can set up a large recurring payment from my account, without my approval?
I'd need solid proof of how that would work.