Merchants eat the costs where no EMV card was used. Customers eat some costs where the bank can prove negligence, and face court if the bank can prove fraud (i.e. signed statement it wasn't you but later the CCTV footage is found. Oops)

Other than that, here in Europe, customers are protected by law from having to take on the liability. Varies by country, but basically it's a case of "you're responsible to see that nobody else gets to take my money, that's why you're a bank numbnuts"