SEPA Direct debit still has a confirmation from the account holder. You usually see the pending transaction before it clears and can block it. Some banks (dreadful and hated bunq for example) require an active confirmation from the account holder before it is allowed to clear. Some have a setting hidden somewhere that sets the policy to autoaccept or something else.

I haven't ever seen illegitimate direct debit. I guess you need to have an actual business to issue direct debit orders and bank will show you the door and freeze your money if you start doing funny things. I guess.

Probably the dreadful R word has something to do with it, go figure.

On cards we also have limits and the only time I saw something happening was after being unfortunate enough to pass through ~~the ghet~~ the glorious capital of our continental Empire, majestic city of Brussels. That time the bank tried their best to call me.