Because the merchant is still responsible for delivering the payment form within their same origin in a secure manner which means that the merchant must secure

Because the merchant is still responsible for delivering the payment form within their same origin in a secure manner which means that the merchant must secure their hosts so that the delivery of that payment form cannot be tampered.