This is not a feature, as very few people expect it to work this way. The mental model people have is that they give out their card number only, not access to

This is not a feature, as very few people expect it to work this way. The mental model people have is that they give out their card number only, not access to the underlying account. If I lose a card and get a new one, I understand it's my responsibility to update that number at relevant recurring charge accounts. Is that annoying? Sure. But if you aren't doing that, it is your responsibility to tell me in giant bold red letters that I am granting you access to the underlying account, and allow me to agree to that, and then confirm again that I really want to agree to that.