To populate the list of credit cards in your account.

I doubt they store credit card data (who does that ?). Last 4 digits would be to display "Your Visa -5555" in a payment method picker

Yeah, I just use google pay with them, which shows nothing, so there's nothing for would-be identity thieves to steal except my name and address hopefully.

it seems to be credential stuffing anyway, so unless you use the same password for every website (unfortunately lots of people do), you should be safe.