Yep, you’re wrong. That is not how tokenization works.
A customer has to check the checkbox to remember the card to begin with, all that does is store a token. Only Stripe knows what this token means. And it only works only on your website only for that customer only for your stripe api key / data. There is no better security. You are worrying about something that is not a problem.
A customer has to check the box to remember the card to begin with, so if you dont want that, edit the code to remove the checkbox from appearing. What you can do with notepad is amazing! 🙂