Sooo, I'm confused...

This is no different than a person selling something on their website with paypal, and in the form:

mysellingemail@myaddress.com ">

Except someone found a way to access the addresses of these prefab coinbase buy-now buttons that these merchants put into their websites?