Until there is a service that has shown it has the chops it takes to securely store user data for a third party, its an uphill battle for these services.
PCI is the main reason to use something like Stripe.
Right now, if you store pi and get hacked, you just apologize in a post mortem blog post and move on.
With PI, if you're data is hacked, there is no penalty from a consortium, like in the case of PCI data being hacked, but it is ludicrous to say that there is no penalty at all. When a website is hacked and loses customer data, it also loses customer trust. The websites revenue is based on it's users trusting the site and coming back to it over and over again. A data leak would (rather has the potential) to be disastrous to the site and it's business. (Ashley Madison is the most recent example I could think of).
I do agree with the fact that for a lot of small sites that just want to identify the user, leaking PI will have almost no negative result. But then, such sites have already moved over to OAUTH, and there purpose is already served.
In my opinion, the merchant processing/gateway revolution happened when providers (Stripe, Braintree, et al) started providing quality APIs for user/profile/subscription management and took the burdens of PCI compliance off of the companies building consumer products.
On the surface, I feel like this is a great way to offload the liability of storing sensitive user data -- though it also creates a central source of failure. Success is predicated on Luno securing their data; if they can't, the model would die.
If they can, it's possible we'll start to see a mass-migration of authentication-based apps switching to these service, if only for the legal intention of offloading liability.
Really, a fascinating model.