ACH is a two-way street. when you give your routing and accounting number to your employer for direct deposit they can pull money out of your account. There have been multiple public instances of this happening due to bugs or bad software. The most recent case involved an HR startup whose founder embezzled his company's funds and thus the banks pulled back the money from the client's employee accounts.

My employer's bank recently mistakenly did the DD 3 times and pulled back two of them.

ACH doesn't come with two-factor auth or any sort of real safeguards, I would be very careful who I give access to.