Yes, if you are paying an Lightning Invoice with LightSpark's API, the funds will go from their custody (their Lightning Node), onto the Lightning Network. So in this case David Marcus won't have full end-to-end visibility into this payment. However, YOUR user is still fucked. He's got their IP address, payment history, amounts, balance, basically everything. But you are right if the RECEIVER is using the Lightning Network, instead of the Spark API, then yes, the RECEIVER gets some security.