And their paranoia is on a very solid foundation. I've been a professional geek for over a couple decades now and it's not a question on "if" your site is compromised it's "when".
Completely agreed on sites, but if I'm putting in the same information for age verification that I do for orders where is the additional risk?