PCI-DSS is actually quite easy to get certified in. I would say the issue is Linode not protecting their customers but as you say it's completely optional and would incur higher costs.