Paypal integrates with existing (non-Paypal-run) bank accounts, debit cards, credit cards, and more, and they have to work within the requirements of the integrated financial products, and those products all have fraud-related rules/clauses/legal stuff I don't understand. Paypal has to minimize their liability toward all the other financial institutions they work with. I sincerely doubt Paypal would be able to work with all those other businesses if their stated policy was to just pretend fraud didn't exist.