Yes, though
they must be a bank or have an agreement with a bank. Random person can't just do it by just having the numbers. And a bank can get in trouble if it allows shady clients access to ACH.
> bank account authentication mechanism is to withdraw some money from your account, and then ask you how much they took
In my experience, it is usually the reverse - they put a small sum there, and then withdraw it back after auth. But the end result is the same, of course (except if you have less than $1 on your account).
> if you have someone’s bank account number you still cannot transfer money to them
That's indeed weird, because I see no technical reason (at least with my knowledge about ACH - btw HN had recently a couple of nice articles about it) why that would not be possible, but my bank only allows me to transfer money to my accounts. No idea why. Maybe some legal stuff?
OTOH there are apps like venmo which make it easier.