is it possible this all stemmed from a hack of debank's signature call? Why does it ask us to sign any way? Like, what is the purpose?

Can be abused if someone is motivated I think. Lots of people use debank and don't even think about that signing.