It's extremely common, and few of them get PCI compliance right. In my experience they usually just feed a website form directly into email.

This is your mom and pops, local bed and breakfast, small specialty store type websites. They hire someone to just make it work.