Regarding "If you don't trust your payment provider to not execute insider attacks, you shouldn't use them" - the trust is partly supported by a long list of things that a payment provider must do to reduce insider attack risks. This includes an obvious requirement that their contact person can't access or know the user's passwords.

So yes, if they're demonstrating that they can't be trusted to do even the basic precautions for preventing insider attacks, you shouldn't use them. Period.