Could not agree more, and just came there to say this.

I work at a small retail store with an online shop. Multiple times we’ve had parents call us to cancel online orders where their kids purchased something using their parent’s stored credit card info. Those things really should be locked behind a password.