I asked why I can't uncheck that box. The reply was "The un-check box isn't working right now. We have a bug fix coming for it with our next release." So there you have it.
Of course I didn't ask them! I didn't want to confirm the simple reality you just confirmed:
A. The coders at APA are so bad that the security of the APA has to be at least as bad and everyone should be worried a data breach and watch their credit cards.
B. They lied to you and the bug is intentional.
I'm hoping for B as they have my credit cards info (which I'm now fearful is stored in plain text on some AWS buxket wide open to the world).
I'm positive that the first automobile was a mystery at first, but after 20 years of popular usage there was way too many people that understood how they worked who could dispel myths about them.
Now take a HTML checkbox. Are they hard to mess up? Yes, so much so that if you release them messed up, you did it intentionally or you seriously, seriously don't know what you're doing and shouldn't be allowed near a system that takes electronic payments. Ever noticed that these bugs always seem to happen in a way that harms you for someone else's profit, but not the other way? Hmmm... seems like "bugs" are great at generating profit. After all, it's better to ask for forgiveness than permission. Oh innocent APA, bless your heart.
Lastly, I don't use the "app", I use a browser (but... so an exploit on 1 would work on the other?). Go find any web developer that thinks a check box on a HTM page such as that one is bugged. Even if you have no clue how a web site works you understand how a check box works (yes, it works exactly like you think even in the code). Technically, you have to add code specifically for altering the default state of such a box. By default the box is either on or off, Javascript has to be added to toggle the boolean state of that element, or to put simply, you have to work to make it happen.