2-factor auth is typically mandatory when using a chip and PIN card to buy things online. Rather than physically entering the PIN on a keypad, you're doing something through a flow using your user account with the bank. So not only would the random retailer need to be compromised, but the bank would have to be as well.

In that case what is the difference between credit and debit usage?

In practice, here in Europe credit cards are often worse because the seller can add additional charges after the transaction using just the CC number (even with chip+pin CCs) whereas this is impossible with a chip+pin debit card.

And the CC "protection policies" aren't that useful here, in my experience it's near impossible to do a successful chargeback and there are few cards with high cashback.

Arbitrary "protection" policies anyone can implement, powered by Visa and Mastercard?