I don't know how it works in Germany, but in the Dutch system, iDeal, I see the amount I'm authorizing. Of course if I'm sloppy and rapidly clicking through my bank's screens, I might not notice it if they changed the amount at the last moment, but any merchant that can be shown to do that would probably be in a heap of trouble.

I do think it's possible to authorize an unspecified amount; automated gas pumps seem to do that, but they seem to be the only ones, and it probably has a hard maximum.

Of course any PIN transaction that goes through the merchant's equipment is not quite as secure and relies on a level of trust that's not necessary for online payments, where I give my authorization through my own bank's website.