The criticism is that better privacy can be achieved by not saving data, it is a good criticism but I don't know how legit it is because I don't know if credit card payments can be processed without saving the data (i would assume yes, if tokenized)