It is less that cards don't have PINs for the chip, but that they still have magnetic stripes. It is still possible to skim the card info. I assume that there is mandate to update equipment but I still see registers with swipe. Issuers can distribute cards without magstripe in 2027. But they keep pushing the date out.

IIRC with most credit card purchases in the US, if the retailer only takes magnetic strips, they're liable themselves; if the issuing bank doesn't offer EMV cards, then they're liable; after that is the credit card company I believe, who has an option to put up to $50 liability on the owner (though they rarely do).