Huh. Cool! As I said elsewhere in the thread, my personal intuition is that Apple is a significantly better steward of my information (and credit card!) than a random small-time dev on the internet, but I realize not everyone agrees.
Plus there are other tools to further layer if it was ever a problem, like virtual credit card numbers. In practice the very nature of credit cards means it doesn't seem to generally be a problem, has been less of a real world risk than hacks of physical retailers. If I see a bad charge, I just report it and get a new number.
Also FWIW, I've seen plenty of sites starting to offer Apple Pay as an option at checkout, I assume it's getting built into more payment systems now. That itself is solid defense, at least as good as the MAS though sometimes the checkout flows seem a bit wonky still.