For the user, there is no real point to such a separation. If the system is full of rootkits and malware, the credit card can be hijacked through for the browse

For the user, there is no real point to such a separation. If the system is full of rootkits and malware, the credit card can be hijacked through for the browser, for example. You don't need to get at the actual credit card processing if you can control all inputs and outputs.