There's still a lot they could do around that though, e.g. requiring that billing details be re-entered upon change or sending an email alerting the user with i

There's still a lot they could do around that though, e.g. requiring that billing details be re-entered upon change or sending an email alerting the user with instructions to secure the account if it was not authorized.