I use Stripe for payment processing, and I'm pretty sure vendors don't get access to customer's credit card numbers. They might be able to attempt another transaction — which would be fraudulent — but you would get an email confirmation and could easily flag any such attempts. I agree that it is wrong of them to avoid regulatory or contractual obligations to use company payment processing, but they don't get your credit card number.