Anecdotally, I've never heard of anyone having a problem getting the charges refunded on a card that's been used fraudulently, regardless of the state of the law. If people were actually losing a lot of money to this type of fraud, I am sure the culture would change, but right now it doesn't seem to be a major problem.

Where does that refund money come from though?

Credit card companies or their insurers I suppose. They must figure it's worth it to pay out in order to maintain their reputation as a secure payment method.