My bank gives me virtual credit cards. Google is just unnecessary expensive middle man. But I live in Europe so US situation might be different.
Though I've never had the above happen. I've had a few times where my number was compromised but the bank found out and gave me a new card before whoever got the number was able to use it.
You can proactively decide when a card will expire and how much it can be billed ("Sure, NY Times, I'll take a subscription for the trial offer of $4 a month, so let's make sure this card only allows a charge of $4 every month and/or expires when that offer expires.")