In the past at least, PayPal has also been known for simply taking funds from your linked banked account.
So maybe it's better to not link a bank account at all, which means leaving funds in your PayPal account until you can spend them (since you have no way of withdrawing).
I do this, but not specifically for PayPal. I have a checking account solely for using with third parties, writing checks, debit card transactions, account linking, etc. It has overdraft protection disabled. All my bank funds are in a “private” accounts that aren’t linked anywhere, don’t have checks, etc.
All banks I've using have strong 3D secure. One of the banks require biometrics approve with installed phone app. I have no issues directly use credit card on random merchant sites for years. Especially when most of them use one of the popular payment aggregators.
you have it backwards. 3d secure is not protection for you. it's for the merchant. it protects them against chargebacks. the merchants decides if it enables 3d secure or not, transaction by transaction. Most of them are using an external fraud risk assessment service. Accertify is such an example.
My credit card provider allows me to create unlimited virtual card numbers with any expiration date I want, that way every transaction can be its own number and any fraud is extremely easy to detect and prevent.
It's not zero risk; changing my card numbers after a compromise is an annoying process given the number of places I have to do it. Not having to provide that number to the random e-commerce site I'm trying to buy something unusual from is helpful, and reduces the risk of me having to spend an afternoon making sure I switched cable, internet, Github, Patreon, Heroku, kids' school lunches, music lessons, and fifty other recurring payments over to a new card number.
(I also get to skip entering card and billing details every time. Given the number of sites that see fit to use a special non-standard widget for the state field, that saves me time and annoyance on every transaction of this nature, too.)
Not universally but a lot of the ACH agreements you consent to have a clause allowing drafts to be initiated on-demand until you revoke that consent. This isn’t necessarily bad and can often be desirable, but then it’s often up to you and the withdrawing party to settle your disputes about what is authorized and what is not.
Paypal will issue physical checks if you want to withdraw funds. They charge $1.50 for this service, but I use it since I refuse to link any of my bank accounts directly. I have a credit card linked, but that's a safer (in my mind) way to deal with any PayPal shenanigans.
Yes, that seems like a good option, provided you can find a bank account that's free with no hoops to jump through. KeyBank offered one at some point, not sure if they still do.
So maybe it's better to not link a bank account at all, which means leaving funds in your PayPal account until you can spend them (since you have no way of withdrawing).