I've noticed that riots saved credit card system features a card security box (for those 3 digits on the back of the card) which does absolutely nothing. I've removed my details as best I can from the clip, but I can assure you my CVV is not 000.

I'm not super familiar with how making card payments work, but this to me indicates that they either don’t need that code to make the transaction or are saving it on their system which seems like a poor practise.

The clip is from League, but the same thing happens in Valorant as well.

EDIT: According to comments, they may be saving a token which authorises future purchases after the first one, not requiring your CVV. Either way, I find it misleading to be asking for it in the first place in this case, and this is not confirmed to be what's happening either.