> "If some nefarious actor has the users credentials (e.g. username / password) won't they then be able to circumvent both of those checks?"
They would. However, typical ACH fraud entails pulling money using only the routing and account numbers, which can be found on all paper checks; this mechanism prevents that.
1) Providing the username and password for online access to the bank account; or
2) Allowing Coinbase to make two micro-deposits to the bank account, and then providing the correct amounts of the deposits when they are received.