If the latter, seems like a small friction point for a consumer. Given how often cc numbers change and how many an (American) consumer has, this won’t block anything unless you are charging back more than once every few months.
If they can’t or don’t want cc numbers (makes sense considering how painful PCI guidelines are anyway) does that mean they need to rely on more tools from the processors or user accounts maintained by the merchant themselves?
Visa and Mastercard each have 14 digits worth of permutations to play with, excluding the first and last digits. That's one hundred trillion numbers.
Assuming 8 billion people in the world, each person can hold 12,500 of either Visa or Mastercard before a collision happens. (As above, the number space is smaller because of how BINs are issued, but that's still plenty.)
I remember getting into an argument with a bank teller about me wanting to block/dispute transactions and how they kept approving transactions. "But you have an agreement with the gym..." That's between me and the gym, not for you to facilitate on their behalf.