> [...] the merchant can send an invoice for a payment. Either the customer manually pushes the payment, or delegates to the bank that each invoice from merchant X should immediately result in a payment push [1].

This already very close to how SEPA direct debits currently operate. I can instruct my bank with one click to stop honoring a given direct debit mandate (they'll then block all further payments under the same mandate reference), request any payment to be reversed for any reason (that I don't have to provide) etc.

The only difference to your suggested model is that the default is to honor all new mandates. I believe nothing – operationally or from a scheme perspective – prevents banks from requiring positive confirmation for every new mandate or even every single direct debit, though, and some banks (but not mine) even support this.

> in the pull system the customer can only beg the merchant (eg. the gym) to stop charging their account.

Not for SEPA direct debits, in any case.

My central problem is that in current pull based systems (both CC and direct debit), the merchant has access to the information to take money from my account. But that information can leak and someone else can take money from my account.

It's insane that digital systems are less secure than cash based system. If a merchant hands me a paper invoice, they can't just take cash out of my wallet.

The merchant should communicate to me where I need to deposit money, and I should put that into my system. The merchant should have little to no information about me.