I actually disagree with this as well. The Hacker News user is not the average user. The average user has no idea what Stripe is, they assume that the business requesting a verification will have access to anything they submit.
I know this because we use Stripe Identity ourselves (in beta) and user's have no idea that Stripe and us are different companies.
> user's have no idea that Stripe and us are different companies.
Doesn't that imply that if there's a security breach at Stripe, that your users will blame you [too]
That seems right. Businesses aren't islands, they work with other businesses to provide their services. But you as a business have an issue with a vendor/supplier, that's still on you. If McDonalds can't get fries, I don't blame farmer X for a failed harvest, I blame McDonalds for a fragile supply chain.
We should figure out who McDonalds' ice cream machine maker is and ask them why their product keeps breaking down.
This might be an interesting read: https://www.wired.com/story/they-hacked-mcdonalds-ice-cream-...
As a consumer, I would expect Stripe would do the verification and give the business partner the result, but not all the data they used to get the results themselves.