I think the point is the insecure payment method was Upwork's decision (they don't even allow their freelancer to propose an alternative their own payment solution) as was accepting the stolen card; risk management of non-reversible payments has a cost too, but that's a decision Upwork made. The only security decision the freelancer made was not to use Upwork's spyware. Which would give Upwork valid reason to default to siding with the client over the freelancer in the case of a dispute about completed work, but not to demand a freelancer reimburse them because Upwork had chosen to accept reversible payments with a stolen card and couldn't easily recover funds from their client after the chargeback.

Apparently the cost of credit card processing amounts to $12.5K, on account of something that the freelancer could not have been aware of. The thing to watch for is whether Upwork improves their processes on account of this happening, changes their terms of service (supply side) changes their terms of service (demand side) or does nothing at all. That will tell you all you need to know.

Credit cards also have fees. When you start talking thousands of dollar transactions CC start being more expensive.

At 1000 dollars 4% is $40.