“Who cares about PII leaks when there have been other breaches” is a weak argument. Aside from being helpful for phishing, leaking the last 4 is enough for the

“Who cares about PII leaks when there have been other breaches” is a weak argument. Aside from being helpful for phishing, leaking the last 4 is enough for the issuer to pull the card, which is a major annoyance if you have other things billed to that card that will now all need to be updated.