As someone who worked for an online store when this craziness first started 4 years ago:
SSL only makes sure noone is reading your digits till they get to the company server. But, the employee of the company, who probably is just some IT guy off the street, can see all the info in the database. For all he cares, he could just print out all the credit card numbers, and order stuff online for himself.