It's not the same, if the merchant's webserver is compromised they can just change the src attribute of the iframe to point to their card number collecting iframe that wraps the Stripe iframe. With the redirect method the customer can see in the URL bar where their card data is being sent to.