I don't know the situation with Michaels, but I think your bank acted quickly and wisely to stop potential theft of all the money in your account.
The problem with debit cards is that, if your account info is stolen, your bank account can be cleaned out within hours. When that happens, the banks have no obligation (as far as I know - different states have different banking regulations) to return your money. With CCs, the CC company will remove most of the charges from your account and investigate.
I prefer the bank cancelling my card number without telling me first then someone looted my account - which leaves you "higher" and 'dryer".
I agree that an email or text message notification would be nice, though. But I can see scammers catching on to that very quickly and sending bogus emails and texts to get you to give your financial info to them.
Why can't people just be honest?