This answer is completely grounded in fact, so I vouched for it. Even without the bank card number itself, many places used tokenized versions of the card number for tracking purposes.
I wonder how many people (as a percentage) use monero "correctly" enough that they can remain anonymous even when faced with the resources of a nation-state hacking team. I'd wager it's single digit percentages at most and even that is pretty high.