(Edwin from Stripe here.) This is correct. I can only speak to how Stripe.js works but if a business chooses to accept Google Pay, we've limited it to loading in an iframe. (We don't load Google scripts on the business's domain.)