The attacker unfortunately doesn't have to use any aspect of the products that the site implements. In my situation I have different subscription levels, but the card attacker disregards all of it. Stripe really shouldn't allow for a card to be referenced without a predefined product also being referenced.

It's almost as is Stripe doesn't want to stop the attacks because they're making so much from fees