The credit card details are pulled from your account automatically and put into the form. I had to give Tesla my credit card number to place a deposit for my vehicle so I suspect nearly every Tesla owner has their credit card on their account unless they removed it after purchase. For owners who purchased without free unlimited supercharging, they probably want to leave the credit card on their account so they can use the supercharger network (the superchargers identify who you are when plugged into the car and the credit card on your account is billed after use, there is no payment mechanism on site). That’s why the “pay with credit card” “button” with no additional validation of user input in combination with a preloaded shopping cart with all options selected is dangerous in this instance. It is literally three misplaced clicks.
I think this could be solved by making the user input the expiration date of their credit card manually in the checkout screen. This is very common practice in ecommerce for this very reason. I also don’t understand why the pay with credit card button doesn’t look like a button. That’s just bad UX.
All that said I do think some of these reports have to be buyer’s remorse because I don’t understand how this extremely particular series of accidental inputs (pocket or otherwise) could have happened to as many people as are talking about it online. However, it does seem possible that Tesla could charge you up to 10K without your consent which should be fixed immediately.