Specifically, they’re cutting off purchases of new games - but people can still download games they own.
The PS3, I believe, did this a while back. Up to a point, patching the device’s internet security so that the credit card info isn’t stolen in transit takes more effort than it’s worth. But, letting people still download their games has no real internet security risk.
One question that lingers in my mind though, is whether you can still buy new games using a desktop browser. I think that was something PS3 allowed for for some time.