I'm not sure. When you give authorization for "all future payments to Starbucks until I tell you otherwise" (which is what you're doing with recurring payments being set up between FB and PP), you're authorizing that payment to Starbucks. You're not authorizing Starbucks to take whatever they want, but that's between you and them, not you and Visa. Visa just happens to be very accommodating and will often pressure the vendor.

Losing your card would have been similar to the OP's PayPal account being hacked.