The most interesting part to me is that this is a regression. Paypal integration used to work like you said, and like I said here[1], though now they seem to favor usability over security.

[1]: https://news.ycombinator.com/item?id=8011614