It's gotten better, but the implementations the first years were abysmally bad. You're in this somewhat skinned payment flow, and then suddenly you're redirected to an un-skinned page, that maybe has your bank's logo on it, that asks for your secret password, or asks you to log in to your internet bank. And you would be on some sort of unrecognizable third-party url, because the merchant redirected you to their payment processor's webpage, which through 3DSecure redirected you to your bank, which in turn redirected you to some partner they used for that, because the bank couldn't figure out how to do it in less than three years because making software is hard or something.

I think I abandoned every such purchase on reflex because it just screamed phishing attempt each time.

Extremely high friction indeed. Most merchants these days give me the option to skip it. Thank you.