You're absolutely right. This was an editorial mistake on my part. Edited to acknowledge the existence of schemes like SEPA Direct Debit. Thanks for pointing it out.
SEPA Direct Debit has the advantage of being instantly revokable from the customers side for six weeks after booking date, that's usually enough for any fraudulent actors to stay away.
Interestingly Banks will take some of the merchants cashflow as collateral, similar to how PayPal does this, to ensure there is actually cash available for the reverse transactions if they should be initiated.