Sure, though not every small project needs to worry about that. Perhaps the payment workflow is a tight loop that has KYC through physical memberships (ID + Photo), say a gym membership for example, and the entire system is private just needs a gateway to do transactions.

Stripe needs all that byzantine fraud prevention, on top of what they had a decade ago, because they are a huge concentrated target.

A smaller firm could be way simpler. Because they simply wouldnt have enough money to provide a decent payday for dozens of malicious geniuses going at them 24/7/365.