It’s lamentable that any of this information still has value to fraudsters. Once it became clear that companies cannot safely control this data, it should have

It’s lamentable that any of this information still has value to fraudsters. Once it became clear that companies cannot safely control this data, it should have been stripped of any value by having some security token under user control provide the actual payment authorization.