> It hands over the customer's IBAN, which isn't really that much safer than a credit card number, since any merchant can trigger a SEPA Direct Debit using it.

this is not true. the IBAN alone is insufficient to authorize a direct debit.