You've moved the goal posts. A typical site isn't storing the numbers so when they get hacked, that data is not available. If you're suggesting hackers directly injecting malicious JS to hijack card data then that's totally different. I'm not insane about this particular subject. You're just standing on a soapbox

The parent post just says "I don't want to put my credit card info in their crappy parking app".

"I'm only talking about long-term storage" is itself a goalpost move!

For example, you have to trust the QR code takes you to the real app: https://www.bbc.com/news/articles/cwyjqg578e1o