Valve has always been pretty awful at granular privacy. For the longest time, no settings between "hide literally everything" and "broadcast to everyone I know every time I purchase or play anything."
Still no setting between those two options, but at least it's on a game-by-game basis now.
Also the fact that on the steam deck there is no choice to add a pin before purchases is mind boggling to me. Hand it to a kid and they could run up serious bills.
As a matter of principle, I don't save my credit card number anywhere. It's a little more tedious when I make a purchase, but I've got my number memorized anyway, so it's not a big deal, and it's definitely more secure in that respect.
I leave my credit card stored with some places, but I specifically don’t leave it on steam just to add a speed bump for me to avoid buying a game unless I really want it. I tend to add games to my wish list, then sort of impulse buy if they go on sale for really cheap, or remove them later if I’ve decided I’ll never get around to playing them.
I’m not too worried about security, worst case I can get a new credit card number. But it seems like steam and other online retailers are pretty good about not leaking your credit card number.
Also in several games my ability to join friends in-game broke if I turned my profile completely private. As soon as I set it to friends only I could join them again.