Having bank details only allows us to put money in, not the other way around, and yes they are safe, our system is a one way only; publicly details can be sent to us, there is no way to display them publicly (this is the reason they have to be entered every time).
Additionally, redemptions are linked to the account's mobile number, and mobile numbers can only be changed by Octopus staff. This way only the owner of the mobile number can verify a redemption, so even if an account was hacked, no money could be extracted without also having the associated mobile phone (and respective passwords).
We do not offer PayPal, they would take a cut of your redemptions. This goes against our goal of getting you the most money in your pocket. If they ever change the processing model, we'll consider adding PayPal as an option.