> If Upwork is the middleman here providing a payment platform, then I'd expect them to swallow the cost of card fraud

Of course! How else would you be able to protect yourself if someone else is handling the payments?