Interestingly, this might be in response to the new PCI requirements.

In the past, if you iframe'd a payment processor site, you didn't need to be PCI compliant while the new spec requires everyone who is involved in the process to be compliant.

I wonder if this will be the future of payment processing, just outsourcing to Twilio and Stripe.