What if the merchant intentionally puts in a different payment code, or uses something generic? As a merchant couldn't you sell cannabis as a generic 'health product', especially if you sell non-cannabis products too?

This payment code thing is one more reason to ditch Visa in favor of Bitcoin. Not only because of the surveillance, but also the messiness of it, the burden of having to enter this data into the system while following a convoluted, ambiguous set of rules that may get you deplatformed by Visa if you do it wrong.