I don't have the experience to know if this is actually the case, but it seems completely plausible that different countries have different regulations (or enforcement thereof) such that US companies have to care about PCI more than Indian companies.
> These $100B in annual sales aren't processed by script kiddies, it's a very large and mature industry.
Those are less connected than you think; loads of companies run obscenely large monetary transactions and essential business processes with horrifying hacked-up systems (50k LoC files, 20-year-old Perl scripts that nobody understands, Solaris 2.x desktop in the maintenance closet...); utility and good code are less correlated than we wish.
If you think about the social security number system, paper checks or credit cards with magnet strips I think you'll notice that other countries sometimes have stricter and more advanced security regulations.
Or maybe even different companies forcing users to accept credit cards in different ways.
A handful providers I had to integrate with in my career (in LatAm and Germany) had this rule where you couldn't have the numbers going trough your system unless you got PCI certification. You had to use an iFrame, or redirecting to their website where the form was served.
Sometimes the APIs were there, in public, but even if you used a valid credit card number it would deny verification unless your merchant account was pre-authorised.
Of the nearly 45-50 contract jobs I've seen, a lot of them use pirated WP or Magento plugins, and plain text storage of sensitive content.
As far as PCI DSS goes, there are multiple levels. Even at the tier 2 Indian ecom company I used to work at, we did not store any card info, it was just submitted in an iframe rendered by the payment gateway. And even then we were subjected to annual/semi-annual security audits (this was in addition to quarterly external security audits we ordered ourselves apart from typical OWASP top 10 checks performed by QAs in weekly sprints).
It doesn't seem like a generalization at all. It's someone relaying their actual experience:
"having worked with many E-Commerce shops in India as a consultant"
It very often happens on HN that if someone talks about something they had personal experience with, that people try to characterize it as a generalization, as if that somehow magically makes the statements a fantasy. It does not.