Can payment be done in pop-up rather than using redirect? We have an online store with a few hundred products, and we'd like to streamline the checkout &amp; payment process.
Currently our payment processor requires the website to be redirected to their site to make the payment, then the user is redirected back to our site for confirmation.

Instead of redirecting our users to the payment processor's site, can we open the payment processor's site in a popup? I think the popup could either be a separate window (though that might be extra complicated), or as a lightbox (possibly using an iframe).

Does Drupal Commerce support this sort of thing, and is it safe to do or not recommended (as a security risk)?

We're using Drupal 7. Our site is a fairly standard online store.
If your gateway tells you to redirect, you redirect. 
If you need a modal-based gateway, choose another gateway.
Changing the flow recommended by your gateway puts you firmly in unsupported waters, and definitely exposes you to additional risk.
This is especially true since redirected gateways require PCI A compliance, while modals require the slightly more complex PCI A-EP compliance.

I would also expect most gateways to have protection against this.