Exactly: it’s not like this was a technological breakthrough but that companies were trying to avoid breaking backwards compatibility - not just things like the readers but backend payment systems using something like fixed length records, but also restaurants needing to stop having a single terminal used for every table (this is why they went chip and no PIN).
Going back to the original comment, that’s the peace of mind benefit I see: those businesses can slack on security without me getting stuck with a potentially massive bill.
That's a false dichotomy, though: Regulators can mandate merchants and issuers to make fraud less likely without allowing the liability for any remaining fraud to be pushed onto cardholders.
I'm just saying that this isn't necessarily a consequence of improving fraud rates, although it's definitely important to keep an eye on issuers – I've heard about attempts to use it as an opportunity to limit liability in the past.
This is exactly what chip and PIN does. The chip is a smart card holding keys; the PIN authorizes its use. Online, there is 3DS which can be used similarly.
We’ve had both of these tools for over 20 years now. It’s just a question of how much the industry is choosing to cater to convenience and backwards compatibility, i.e. a security/availability trade off.
In Europe, the regulator has made the choice for the industry instead.