People still trust all of their passwords to third party closed source vendors who are
prime targets for hackers?
Wow.
It's worth mentioning that it's super easy for a seller to create a PayPal invoice, and that you should always ask them to do so:
https://www.paypal.com/uk/webapps/mpp/email-invoice
The invoice should list exactly what goods and services they are contracting to provide, what condition they're in, and how and when they will be delivered. It forms the basis of an agreement that PayPal can see and act on if shenanigans are afoot.
If a seller won't do that, then I'd let someone else take the gamble on them.