I like the convenience of paying my bill using direct deposit. The only complaint I have about it is that they send you a reminder to log on their web page to see the bill.
Since I have the amount auto debited each month I have no reason to log on to their web site.
I have ask many places many times to just send me an email of how much the bill is and when it is drafted. There is no reason to setup a username/password for this kind of stuff.
If I wanted to cancel the service or add to the service online, I could see where another level of protection would be required. We are talking about a water bill, not a CIA document.