I think of it more as "no username, only password". Realistically, usernames are not expected to be secure or private, so this is effectively the same.

There are lots of possible account numbers, much more than there are accounts. So there is a very small chance that you will guess an active paid account.

And if you do, there's not much you can get out of it. There's no personal information tied to the account.

Nowadays, not so much. In the previous decades before password managers, card vaulting, apple pay and so on: yes, if you were typing it in or writing it on forms frequently, it wasn't uncommon to just memorize it.

My point though was that there is a limit to our ability to remember long and random alphanumeric strings, and I find credit card numbers to be that limit. UUIDs are longer and have a much bigger character set.