It is not logical to both present something as FACT and then also admit it is speculation.
If I flip a coin 1000 times it will probably land on heads at least once.
Thousands of huge corporations have continuously been caught up in data dumps, hacks, insider schemes, etc. Especially with data that has no liability. This case is statistically unlikely to be any different.
Now if I had made this up in a world where experian, Adobe, capital one, etc didn’t happen, then I could see where you’re coming from. But I’m not, this is the world we live in and it’s rightfully why people get upset when companies suck in yet more PII.
The former is a fairly defensible position. PCI standards for this sort of data collection should be a government matter as they are the ones requiring this information to begin with. The latter isn't based on reality and not worth arguing about.
Don’t worry though, if you request to have it deleted I’m sure they’ll remove the link to the S3 url from their database. :/