> Granted, PCI is so weak it is almost useless, and yet still better than anything congress could have come up with.

Elaborate, please?

See the endless PCI compliant companies that get hacked. Any standard that has a threat model accepting trust in any single human or computer is security theater.

PCI enforces some good practices, but for instance has no defense against supply chain attacks such as code signing, review signing, reproducible builds, full source bootstrapping, etc etc.