And they do not. What they do do is offer a portal where the hotel can look this information up and they very explicitly caution against photographing or doing other stuff to that number other than to enter it into their POS to perform some transaction.

And even though I've not worked there in many years, I can tell you with extreme certainty that booking doesn't do that. They're also (hopefully obviously!) PCI compliant.