doordash is regularly audited for PCI, they almost certainly store raw CC#s and follow modern tokenization standards. The best the agent would see is the name you stored for the card if you have multiple cards it can pick from in the account.
You can pull the PCI compliance documentation from their trust center if you are a partner https://trust.doordash.com/
For addresses, it's a almost certain the agent would see those since those are visible in the UI when ordering and required for selecting a destination for the order
It's plausible, but also, AI systems have a long history of being plugged in on the wrong side of security boundaries.
Remember when you were able to take over any Instagram account by asking the helpful support AI to send a password reset to an email address of your choice?