Comment Hard to be surprised. (Score 1) 30
It's overwhelmingly the case that vendors hate returns and chargebacks; and generally try to avoid situations where those are more likely to arise. An error-prone mechanism that acts "on behalf of" in a way where it does have the user's credentials and payment information but may well not have their authorization in a legally binding way when it decides to order 100 of something seems like the last thing they would want to deal with.
Maybe someone will manage to ram through glorious-agentic-future and it will become de-facto mandatory to cater to people who have abandoned ordering from websites in favor of prompting bots to order for them; but until that happens it's hard to see merchants reputable enough that they are interested in keeping their ratings and relationships with payment processors in good order wanting to touch the situation. Now, scammers who already hop between expendable presences as soon as dissatisfaction catches up with them; those are probably quite interested in the future of prompt injection based advertising.