While there will be a lot of opinions around this, from a numbers viewpoint, I believe that having a common payment site independent from your other web sites is more economical and secure.
Reduced attack surface. The single site should have a very simple API for your other sites to consume: "Customer X wants to pay amount Y for order Z", that sort of thing. This limits the possible ways for an intruder to violate the system. As you need to examine every single input for a flaw, there are simply fewer inputs to examine.
Reduced audit scope. When you start dealing with payments, you must deal with PCI compliance. Payment systems are really onerous to certify. You don't want to have to pay the auditors extra to crawl over all your app servers just because they may have some payment data in them.
A breach can easily be more disruptive than you imagine. If you're thinking that you're going to expose either X accounts hosting on one server each, or 2X accounts hosting on a common server, either breach has the potential to be so detrimental to your common business that both entities may go out of business entirely. Let's see if I can draw this:
Number of |
accounts breached | Progressively larger impact to business
10^1 | Small fines, increased auditing
10^2 | Larger fines, greatly increased auditing expense
10^3 | Internet/Yelp impact to brand reputation, lawsuits
10^4 | Local newsworthy impact to brand
10^5 | Class action lawsuits, regional impact to brand
10^6+ | National/international impact to brand
At every point on the scale your business' very survival is at increased risk. Would risking 2X accounts because you include two web sites change the potential impact? Not so much.
I think you're better off pooling your resources and securing a single payment site. And the more you look at this problem for smaller retailers, the more I recommend contracting with a payment gateway, and offloading that risk from your core business of selling widgets or gizmos. If a payment provider is breached, that generally won't reflect as badly on the web sites that used them. If it helps, think of the extra cost as an investment in reputation insurance.
Even if you choose to go with your "version 2", I would still recommend each web site maintain its own payment gateway as architecturally independent from the rest of the web site as possible. That means separate payment servers from the web servers, separate databases for payment data, etc., for the same reasons: to reduce the attack surfaces and decrease audit scope.