I believe the PayPal Vault just stores the card token. So if an attacker were to grab that token and some other sensitive information from your server, the worst he would be able to do is charge the person's account to your PayPal account, approve refunds, etc. The customer's actual details will stay private as they are not transported from the vault.
The way I see this working is in this wise:
Customer ---card number---> Your server ---card number---> PayPal Vault
Once in the vault PayPal generates an ID for the card and sends that back to you:
PayPal ---card id---> Your server ---card id---> Database
So later, when you want to use it again:
Database ---card id---> Your server ---card id---> PayPal Vault
PayPal then matches the ID to the card number stored in the vault and charges the card.