Indeed - I suspect the services that were most vulnerable to this type of scam were those where a QR code linked to a mobile-responsive website, rather than an app downloaded from Google Play / Apple Appstore. Quite a few of these mobile responsive web apps were spun up during / shortly after COVID for table service as considered easier than creating and publishing an app. Possibly, the same is true of the car park payment services now too, though it's not an area I'm terribly familiar with.
All car parks I've seen even vaguely recently use apps. The most common is RingGo, then PayByPhone, but there are a few other odd ones e.g. NCP have their own, and some railway car parks use either APCOA Connect or Saba (or Trust, which is an add-on to some of them that does automatic payment via ANPR once set up, which is handy to avoid being fined if you go to pick someone up but stay more than 20 minutes).
It is a faff to install them, but once you've got all of the common ones they're there and quick and easy to use, and you can be sure of no scams other than the price of the parking itself!
Regarding pubs, it doesn't help that some of those sites are absolutely awfully designed, and so identifying a scammer might be hard. But as someone has said, it's fairly likely you'll notice the lack of food/drink quite quickly and report the scam (so they'll not get chance to use your card details), and none are going to be clever enough to interface into the pub's systems so the order would still be delivered. And for me at least it'd already raise a concern on a new website if the online two-factor authentication wasn't requested, as most sites/apps now do do it. (Which itself reduces the usefulness of a set of card details anyway!)
For those ANPR-weary, the camera which scans the number plate is usually low down at the entrance, they don't continually track you around the car park (yet...)
Don't know about you, but I would pay extra for them to install cameras to send £100 "fines" to the lazy <naughty word>s who wilfully drive round car parks the wrong way even where there are obvious arrows, and get their back up when you just stop blocking them and give a "turn around" gesture.