Yes. To me, it's whoever's in the best position to reduce fraud that should be responsible.

It's Upwork who can verify payer details, implement identity verification, require back-up payment methods, etc. If Upwork isn't the primary entity feeling the pain when a stolen credit card is used, then they're not as incentivized to address it. And there's nothing the freelancer can realistically do, aside from maybe limit risk by breaking the project up into smaller costs.