The critical feature is you can specify a credit limit and expiry period for each virtual number. By keeping the credit limit at a bit above the purchase amount you dont' have to worry about losing a bunch of money if the number is abused, and by keeping the expiry at 2 months (12 months max) you avoid any abuse channels that would take more than 2 months to transact on the dark market.

edit: And of course you have the credit card company on your side to assist with fraud awareness and refunds. You won't get this with Paypal, Android/Apple pay, and especially not with any blockchain technologies where there is no intermediary working on your behalf.

I keep a Citi mastercard just for the Virtual Account Number feature and use it every time for online and phone purchases. The BofA feature has some severe issues.