Can someone steal your money with your bank account number?

The answer to your question - Can someone steal your money with your bank account number is that the following is based primarily on US Banking, but most countries have similar risk management practises if they follow Basel Practices.

To perform an ACH requires a routing number and an account number. However, for an ACH to go through requires it to pass internal controls and screens. The bank is required to monitor for fraud and if you are making irregular transactions for your account they should detect it. In the US, hopefully they are complying with the federal regulator's recommendations to implement layered controls FIL-50-2011, e.g., there is so security-gate to go through to move money out (e.g., out-of-band one time  token, such as SMS one time code). Also, in the US, you are protecting against electronic funds transfer fraud through Regulation E. Regulation E allows you to make a claim against fraud. Often the bank can reverse fraudulent transactions. You may want to read this paper by Microsoft Research: Is everything we know about password stealing wrong? (PDF) It addresses the risk to individuals of bank account compromise.