Exactly. When you pre-authorize money to be removed from your account, the bank will happily believe every future charge from that party. From their point of view, your emptied bank account is your problem.
In fact, some banks will not even give you an effective means of removing such authorization. You may literally need a new bank account to keep your account from being emptied in the future.
There really is no such thing as "pre-authorized" from the bank's point of view. You never tell your bank "it's OK for Utility Company Foo to debit my checking account"
You give the bank's routing number and your account number to the utility or whomever. That's all they need. That information, by the way, is present in clear text on every paper check you write. The bank doesn't pre-authorize anything, nor can they block anything short of closing your account and giving you a new account number. Your protection is that presenting a fradulent check (electronic or physical) is a crime.
Actually, there is. If you're doing ACH, you need an authorization, in one of several forms depending on the circumstances. The bank doesn't check the authorization unless there's a significant issue, but they have a right to demand it. I've only seen it happen when there's been a bunch of fraud going on.
You can reverse ACH transactions by going to your bank and filling about a form and making a declaration under penalty of perjury. It goes back to the merchant as an R10, and the merchant usually deals with it in some other form, though if they've got a good relationship with their bank, they can dishonor the return.
In fact, some banks will not even give you an effective means of removing such authorization. You may literally need a new bank account to keep your account from being emptied in the future.