While there are flaws with using credit card verification it is actually a better option than government issued ID or facial verification.

A credit card expires. It can be cancelled. Your personally identifiable information- from your government issued ID does not.

There are strict regulations around how companies can handle credit card data and unless Valve want problems with payment processors they will follow these rules to the letter.