There's a bunch of companies (utilities such as power companies, for example) that allow an individual to set up such direct withdrawals. They also seem to let you do this without any kind of special authorization from the bank -- I've done this many times and I've never been forced through any kind of bank login to authorize them to withdraw money.
In Norway, you have two systems ("avtalegiro" and "autogiro") for direct debit. You have to go through the bank to authorize the setup, and you have to specify a max amount. There's also a system called eFaktura where companies can send digital invoices to your bank account; paying them requires going into your bank's app and approving each one individually.
Someone I know had checks stolen and the people used the info on the checks to pay their electricity bill. The police were notified and even though they new exactly where these people lived, did nothing. The only thing to do is close the account and open a new one. What a stupid system for the user, but the banks don't care enough to change it.
Only protection you can offer yourself as a business owner is having a separate account, keeping the absolute minimum required and sweeping balances off to another account as fast as you can. I feel for Etsy, as someone that has built a funding system, the thought of this type of event use to give me nightmares.
I only guarded by testing as if people's live depends on it, because it really does. Screwing up someone's account could mean them not being able to afford food, rent, could be the start of an eviction, job loss, losing their business, not paying employees, many other terrible events or worse taking their own life.
Circuit breakers are also important. If Etsy typically does 2,000 withdrawals on average, and one day their system has to do 50,000 ACH debits. The circuit breaker should kick off so someone can review and manually push it through if correct.