if you review your monthly statement, the "risk" is the possible inconvenience of having your card replaced. I don't let it stop me from ordering my favorite takeout, but you do you.
I guess someone could probably treat themselves to their own monthly takeout order without me noticing for a while, but at least to me, this minuscule risk does not seem worth the mitigations you are taking.
Furthermore, many people use debit cards backed by an actual bank account and the vast majority of people can't afford to have those drained in any meaningful fashion without experiencing some severe consequences.
And thirdly, when the equifax breach happened I didn't bother doing anything. Why? Because I do NOT have the attitude that it's ok to be defrauded of money since someone else will pay for it. There was nothing for them to go after.
If enough people do chargebacks the payment processor will drop them because the ACH operator representing them will 100% fine the shit out of them if they don't. It's all contractual.
My point is, if you want to put a dent in stuff like this, do a chargeback. Like a union, the power isn't in your action, it's in the action of many.
---
But also, this is why I'm very picky and have quite often refused to purchase something I wanted. I'll trust Walmart.com in a way I won't trust momandpop.com. Unless they're using a payment process that isn't handled by them (CC via paypal, for example) I just flat won't use them.
What's worse is most people don't even consider the risk to calling in an order from a local restaurant for delivery (chinese, for example). They may or may not save your CC information and you have no idea how well those systems are secured. They're probably using a 3rd party, but you don't know who that 3rd party is so you can't even begin to assess that risk.
I'm not a fan of doordash by any means, but they do offer a service here in terms of risk assessment.