It is, and most places that set it up typically require a voided check. I was working as a contractor for a large legacy big data company a couple summers ago and getting paid through their contracting agency. Said contracting agency sent me a check image (of my own check) by email TWICE [0].
I was pissed, had to close that account and re-set-up a bunch of banking stuff, and told them they were going to pay me by check because they clearly hadn't the faintest idea how to handle an account number securely.
Having a system where you can do this yourself online or with an app without sending check images around is so obviously superior it's laughable that we still do it this way in the US.
Lacking a superior system, it's preferable to use a system that doesn't involve trusting a bank account number in an electronic form to a (possibly incompetent) third party.
[0] I'd faxed it to them originally along with my I-9 docs. They couldn't read my passport, so they emailed me the image that also included the check. Nevermind that I'd told them that I would not, under any circumstances, be emailing them that data. Sigh.