The IBAN is also used for paying online by debit note. So somebody who knows your IBAN can theoretically buy stuff using your bank account. You can easily reclaim that money, but still there is hassle involved.
How does that even work?
or dont do anything and direct debit by default doesnt work