What's needed is a better system for approving who is allowed to make withdrawals from your bank account instead of just "anyone in possession of your bank routing information" which makes customers reluctant to provide it.

This would be essentially solved with a standardized system for customers to give each merchant a separate bank account number which really refers to the same bank account but could be revoked individually if that one is compromised or you want to remove the merchant's access, but the banks don't have the incentive to provide this when they're the ones getting the credit card fees.