As others pointed out this is a rather standard flow handled by the account updater service[s]. What I would add is most of the time the merchant doesn't store your payment instrument data other than last 4 digits and an expiration date just so the card in your "digital wallet" can be identified in the UI - "Your Visa ending in ...1234" type deal.

Instead, they store a token provided to them by the payment processor which represents the card. That token stays the same even if your account info gets updated. So the only thing the merchant updates is the "metadata" of the payment instrument for end user's convenience. The actual heavy lifting associated with the update is handled on the payment processor side.

That said - from what I understand Amazon is a bit of an exception here and they actually store the full blown card info (other than CVV which is "illegal" to store) so they have to deal with the implications of account updates themselves.