There's a tradeoff. Card numbers in your db are a lot easier to move between payment platforms than tokenized card numbers. So many merchants get screwed by payment platforms that lock them out right in the middle of a large sale because the sudden increase in transactions looks like fraud. You gotta look out for number one.