> I don't get why more banks don't let you generate a unique card number per merchant so if it's compromised it affects at most one place.

A lot of them do. Here are some examples:

https://www.cardbenefits.citi.com/Products/Virtual-Account-N...

https://www.bankofamerica.com/privacy/accounts-cards/shopsaf...