You have accepted their right to do this in the t+cs so no unilaterally. It doesn’t seem that unreasonable to me, if there is a problem with the transaction it’s PayPal refund it, which is what makes buyers feel confident using that route.
Presumably they have some filters that decide whether to do this to a specific customer transaction. If I was designing such a thing I would look at things like: whether the user has validated their PayPal account; the relative size of this transaction to others; the frequency of recent transactions; the number of payment methods on the account we could recover funds by; previous history; and perhaps things like: which IP address you’ve logged in with; how secure your password and email address appear to be; etc
Perhaps by optimising your account settings you can reduce the chance of this happening?