That's the ideal, but not always the case. Last time I read the PCI rules, merchants could (still) handle/store card details just as they could before the hands-off approach existed; it just required someone to attest that precautions were taken. I'm sure you can guess how foolproof that is.

At least that's how it's supposed to be. You're really not supposed to store card info yourself.

Don't forget that we're talking about a company that took 3 years to add a shopping cart to their store

My last role was in payment processing and this is exactly how we did it.

Just don't use a debit card?

Credit cards have all sorts of consumer protections if the card gets stolen.