Just a heads up it actually works both ways. The originating depository financial institution (ODFI) can submit debits (pulls) or credits (pushes) which are then ultimately transmitted to the receiving depository financial institution (RDFI).
Often banks and credit unions will limit ACH origination to debits (pulls) in digital banking applications for risk and business reasons.
You are right that ACH (and most payment schemes in the US) have substantial deficiencies in terms of security, but that is counteracted with a strong justice system and consumer laws. You shouldn't really fear about someone emptying your bank account (unless you are a business) because Regulation E mandates that banks and credit unions make you whole for any fraudulent transaction reported within 60 days of the statement that includes the relevant transaction(s).
Often banks and credit unions will limit ACH origination to debits (pulls) in digital banking applications for risk and business reasons.
You are right that ACH (and most payment schemes in the US) have substantial deficiencies in terms of security, but that is counteracted with a strong justice system and consumer laws. You shouldn't really fear about someone emptying your bank account (unless you are a business) because Regulation E mandates that banks and credit unions make you whole for any fraudulent transaction reported within 60 days of the statement that includes the relevant transaction(s).