It's not silly. The point is that security codes are only ever supposed to be sent in transit, and the only place they are ever stored is by the issuing process

It's not silly. The point is that security codes are only ever supposed to be sent in transit, and the only place they are ever stored is by the issuing processor. It's not supposed to solve every potential vulnerability, but there is a whole class of exploits, exactly like the one in the article, that result from stolen storage, that this rule is designed to protect against.