Offsite payment method example produce mass posible security hole in payment methods in future

I have found problem in \Drupal\commerce_payment_example\Plugin\Commerce\PaymentGateway\OffsiteRedirect::onReturn example
I suppose that this is success page\callback after payment.

In onReturn method you should return regular page with congrats or do simple move forward throgth chackout process

In onCancel method you should return regular page with fail message or do simple move backward throgth checkout process. for some "strange" payment gateways it is possible that we can implement some fallback mode to move payment from pending to fail status.

In onNotify method you shoud change payment status according to info recived from payment gateways.
You must know that change payment status allowed only in commerce_payment.notify route because only there all normal payment gateways guarantee that returned payment data is complete, signed and integrity validated by payment gateway. All other point where payment status change is regarded as security hole and not allowed

also you must know that for normal payment management from drupal commerce side it is required that payment should created on payment form build/process phase, because in other case payment can initiated by visitor but manager can't help if something wrong with payment initiation. So buyers will be lost.