I get the concern. At the same time, when my card was stolen last year, it was helpful to not have to update my billing info on 8,000 different vendor websites or risk having an account cancelled. I think tying a credit card to an account number versus an account as an entity is becoming somewhat antiquated.
It goes both ways, a couple years ago I had to deal with a scammer who the bank kept "helping" with each new card they issued me. It happened like 5 times before it stopped, nothing I could do.
You issue a chargeback. It's been a while since I've worked on these systems, but IIRC back in the day you would get a refund and they would be penalized an extra $25 or so on top of it. If they get too many they can loose their merchant account.
We always made cancels easy in our system, and if someone issued a chargeback we would ban their email from signing up again.
If you use the iOS app for Bank of America, there's a "dispute this transaction" button for every charge. If you click on that, you'll be informed that your card will be cancelled immediately for your own protection, and a new one issued. When what I want is to charge back to a vendor who never shipped and won't refund when contacted. You have to get on the phone, wait for half an hour, and then be very nice about the whole thing, while trying to avoid a card replacement, which is easy and safe for them and very hard for you.
I did, the charge back process wasn't the issue. Each time I would call, they would give me a new card and number, I'd go update everywhere. Then a few days later there would be a new fraud charge on the new card.
That's one of the reasons I enjoy using PayPal and Google Pay. Because my payment card details simply aren't on file with any vendors anymore. And I get a dashboard full of recurring payments where I can unilaterally cut anyone off. And I can modify which payment card they're using for each.
Missing a payment and having to pay a late fee or interruption to an important service seems bad in fairness.