Re: "the scanning is done with Javascript running locally"
"I get VERY grumpy at etailers that try to introduce 3rd party scripts at the final stage of a payment process;"
I get very grumpy at contract suppliers who do it at any point along the way. GDPR and personal data harvesting tends to figure in such complaints.