Absolutely correct. I worked at one of the "big 4" fully PCI compliant/validated credit card companies for years, and while I do not feel comfortable getting in

Absolutely correct. I worked at one of the "big 4" fully PCI compliant/validated credit card companies for years, and while I do not feel comfortable getting into specifics, it shocked me how many potential vulnerabilities I observed over the years. Many emails to INFOSEC were written.