Those iFrames cause all kinds of headaches when the user hits the back button or double clicks a submit button or does any number of other things that happen thousands of times a day on a moderately high traffic site, and when it messes up you either miss out on a sale (ouch) or charge the customer twice (double ouch).
They usually don't tell you they do. For example, both Stripe and Square use iFrames; otherwise it's not possible to hide credit card entry from your main application.
There are gateways that redirect you away and return you back after payment, but that's a whole another story.