For shops like Valve only if they need SAQ-D in case they want to store the credit card numbers on their own, I'd say? SAQ-A til SAQ-C is doable for any e-commerce company.
It's likely they would need on-site visits from a QSA if they wanted to go all the way into this. Valve would fall into the Level 1 compliance category. Self-reporting won't work for that kind of transaction volume.
