That is largely down to the liablity being on the end points of the transaction not on the transport layer...

Either the consumer or the merchant bears the cost for fraud, rarely does paypal or the banks if they did the problem of identity fraud would be solved, and would not be called "identity theft"