It exposes you (the merchant) to PCI auditing requirements (which isn't mentioned once in the article‽) far in excess of what you'd get if you just used the vendor (be it Stripe or Adyen or Square or Paypal or whomever your payments process is)'s tokenization. You don't
really want that. It's a total distraction and bunch of noise if your core competency isn't payments processing.
Doing your own tokenization isn't going to shield you from chargebacks or their costs.
