[raverbashing]

Yes

But if that happens, it's not your responsibility (at least not 100%), it's theirs

[hopeless]

Following the traditional responsibility/accountability dichotomy: They are responsible for storing the cc number securely but you are accountable when something goes wrong (because you gave them that task)

Much like Linode are responsible for hosting my clients site but I sigh am accountable when something goes wrong.