Yeah that is true. I guess in the end you still have to trust the site unless it uses the stripe hosted checkout.