Kobelt is a difficult case because the High Court split closely and the facts were tied to a particular remote-community credit practice. The majority did not find statutory unconscionability, but the decision should not make any business comfortable about taking control of customer cards, PINs or income streams.
The safer business reading is conservative. If your model involves credit, vulnerable customers, repeat deductions, informal accounts or practical control over a customer's money, you need compliance advice before scaling it.