There is a bit of a difference between a massive data breach and receiving a single credit card number via email. As a US resident I hand my card to a server all the time, and they then disappear somewhere in the back to swipe it (or copy it, for all I know). While not ideal, if they’d let me choose a credit card for the refund, I’d be okay with giving them one of my sock drawer cards for the credit. Of course, if they charged a card, they *should* have the ability to refund without needing to enter the card again.

The other thing… you have an issue with particular property, not with Marriott corporate.