I've worked on this problem in the past; musefan's comment is exactly why you see hosted order pages.
Many payment systems offer APIs that can be embedded seamlessly into a site, but then your organization becomes responsible for keeping them secure, and hackers spend a lot of time performing junk transactions and other attacks to breach your site. If you're a smaller organization without a big infosec team, a hosted order page brings a lot of peace of mind.
Why not embed the external payment page in an iframe? Here's what I ran into:
- iframes don't play well with responsive design. You end up struggling with making things work on a variety of viewports, and it looks hinky.
- The hosted order page provider usually limits how much customization you can do. You can usually get the CSS looking 90% like your site, but something won't match, and again, looks hinky.
- Cross-domain warnings can pop up on occasion. The iframe is https, your site is hopefully also https, the certificates don't match, and browsers get mad and throw warnings about embedded scripts, images, and other stuff. Users don't like entering sensitive info into sites that throw warnings.
Hosted order pages aren't the greatest experience, either, but users can be prompted to expect them, and they "feel" more secure. The payment gateway or provider is 100% responsible for keeping them safe to use. It's better for the user, and better for the merchant.