Subscriptions don't need to 3-D Secure every transaction, the initial transaction is considered identified and the auth code is re-used for subsequent charges until you revoke it.

For Amazon and other larger merchants I feel there is some rules system taking as parameters the merchant size (also as a "trustworthiness" score of sorts), recency of last identified purchase (or even some kind of re-using identified auth codes on that merchant), and amount of purchase since almost all larger purchases I make online seem to require 3-D Secure even on larger merchants.

It's not a big hassle, sometimes buying through a new checkout process requires me to authorise the transaction even for small amounts but where I live I can do it through a electronic identification app on my phone, takes some seconds.