"but merchants can almost always force an authorization that cannot be blocked."

This is not true. They cant override a limit or bill a vCC that you disabled.