Apart from outsourcing credit card data, what else could be different when that data is more secured than the more important personal data?
It's almost impossible for those of us who've grown up in the last 40 years of commercial computing to imagine.
But it's possible to radically decouple identity from function.
They just keep the eggheads around as pets.
It's said thrice, but when you remove the monetary greed, you have Mullvad VPN.
P.S.: Yes, I say monies specifically, because the people who use "monies" as job parlance has the most monetary greed from my experience.
mullvad.net was interesting to me because I could pay with Monero, meaning that they may actually have no data about me whatsoever except whatever is technically required for a VPN connection. Pretty cool company but it seems like the sort of model that would struggle in most countries with the amount of financial monitoring that tends to be in place.
Having had conversations with people on security and anti-fraud teams, many experts clearly share this view.
That would probably be bad for tax receipts though, so it's more realistic that there's an upper bound on infosec related fines