Especially when most stripe using sites embed the payment request in their page and there's no way for end users to tell that it's using stripe without looking

Especially when most stripe using sites embed the payment request in their page and there's no way for end users to tell that it's using stripe without looking in the source of the page. If that got re-directed by an attacker 99+% of users wouldn't notice I reckon.