Isn’t this why these ‘headless’ solution have (or are actually built on) JavaScrict engines like V8 with the ability to also simulate any user interaction?
Indeed. I think the story here, isn't so much about the loss in transaction fees, but how an attacker in Russia ordered and paid for a user in Australia's account.
I notice the victim uses Android: Is it rooted? What other random stuff do they have installed? etc. etc. - because that will make a huge difference.
The point I was trying to make is that the days of yore OP was alluding to where when I "put any of [my] code on the Web, [...] I can read it" are long gone, thanks to the obfuscation of modern bundling technologies.
By the same logic, all compiled code (including WebAssembly) is easily reverse engineered if you want to know how it works.