Yes, anyone can spend to a contract.
No, there is no way to withdraw from a contract if there isn’t code in the contract for doing this.
Typically, making a spend transaction to an account isn’t something you would want to do at all.
We made the design decision to not run anything “by default” when spending to a contract. This to prevent behavior that goes against the Principle if Least Surprise. If you want to run anything at all, you need to make a call transaction.
However, we did not want to remove the possibility to spend to a contract, since it might solve some hairy potential problems (e.g. an under-funded contract that cannot do anything)
We do see that spending to a contract might cause some bad situations as well, so the suggestion was brought forward to optionally prevent It by declaring it in the contract.
This would be mostly to prevent mistakes, or to prevent some sort of malicious funding of a contract to change some constraint in the contract.
We are currently not working on this, but it is on the wish list from our active contract writers.