Many issuers limit the number and dollar amount of payments that you can make from a newly linked bank account, some do this even if you have used the same bank account to pay other cards from the same issuer.

Point well taken on the credit card issuer, but I wasn’t thinking so much of the issuer as I was of the bank in whose checking account the money is stored. How does the bank know that the issuer didn’t link the account on its own?

The issuer is responsible for properly validating the payment. If there is a fraudulent withdrawal, whether that is due to an internal fraud at the issuer or because some outside "hacks" an account, it is the issuer which is responsible for the loss. The consumer, of course, is made whole by the bank from which the withdrawal is made.

The good thing is ACH is traceable, but banks are supposed to do a test (it can be a zero value transaction apparently - some banks hide these, some show them).

Zelle is doing something even more interesting. It does seem that misrouted transactions are a thing, and there does appear that sometimes Zelle or the member bank can't reverse them. So, when you add an email or phone number, there is some sort of check verification happening. What this means is that before you send the money, it will sometimes tell you the name of the person attached to the destination if your address book entry is not similar. This is pretty imperfect and might be an identity leak actually, but the desire to have frictionless transfers with some sort of protection is causing some of these issues.