It didn't. This is a known attack vector; the decision has been taken that the costs of cancelling fraudulent transactions are less than the benefits from allow

It didn't. This is a known attack vector; the decision has been taken that the costs of cancelling fraudulent transactions are less than the benefits from allowing easier payment.