Hosted iframes on an e-commerce website are not new. They've been in use for years. It should be pointed out that this type of solution is no longer out-of-scope for PCI. Version 3.0 of the PCI DSS brought this type of solution into scope, so merchants using this type of solution move from 14 to 139 requirements (SAQ A to SAQ A-EP) and are now in scope for external vulnerability scans. Using tokenization with hosted iframes is also not new.