1) Yes, much like if someone finds your credit card number, they can't use it without your name, CVC code, and zip code.

2) It doesn't matter how secure you make it, because if your payment system is impenetrable, I'll just steal your account on some site where you've already enabled payments.