That assumes it's a zero-cost decision. It's extra friction in the payment process (the CVC must be entered and must be entered correctly) which has a non-zero

That assumes it's a zero-cost decision. It's extra friction in the payment process (the CVC must be entered and must be entered correctly) which has a non-zero impact on genuine transactions. They "should" only force it if its benefits exceed its costs. According to a sibling comment from someone at Stripe, they reduce genuine revenue by more than they reduce fraud costs.