If you also ban virtual and pre-paid cards it cuts this to almost zero.
There is a difference, this rocket company is not really going to generate a new virtual card every time? You think their business bank account even supports that?
Considering it's a startup, high likelihood they are using something like Brex, which does support virtual card numbers.