> Maybe the answer is something in between? Banks suck, so they've implemented chip cards in a half-assed way with gaping security holes?

This is the problem. Some banks don't verify the signature/iCVV.