I think you’re also underestimating the degree to which normal people hesitate before putting in credit card details on a web form - almost everyone has heard stories about difficult cancellation processes, stolen card databases, etc. Services like ApplePay offer assurances that almost certainly result in sales which otherwise would not happen, so I’d expect this to consolidate on a few companies (Amazon, Stripe, Google if they can stay on message for more than a promotion cycle) which are relatively trusted as intermediaries.
If you don’t believe me, ask a non-tech-sector family member what they think Apple Pay is.
Who said anything about first principles? I’m describing real problems which are well known in the industry – and having been involved since the mid-90s I wouldn’t say that “indifferent and clueless” is remotely accurate. I know more than a few people who’ve had to replace cards because a small vendor was compromised and, unsurprisingly, they favor Apple/Google/Amazon now.
Most of the non-tech sector people I know think Apple Pay is what they use to buy coffee, lunch, groceries, etc. It’s not just tech sector people using it — if you look at their usage numbers, the tech sector just isn’t that big.
The most powerful force in play here is consumer indifference, which Apple have been relying upon.