as to the original question the system i run debits immediately – though we try to maintain stock level data that is accurate so prevents orders being processed if we can’t fill it straight away
i think as a consumer you actually benefit in two ways (though may be not in this case!)
the first is that as payment had been taken you can argue that a contract exists – see someone like PC World’s or Argos’s T&C for some real weasel work on this though
secondly it means probably was done as an automated transaction directly with the merchants card processor – a zillion time more secure than someone keeping your card details on a database or scrap of paper until they decide to get johnny (thats the one who has mates he can sell the info to) processing the transaction manually