One word:

Insurance

Credit card "security" is not what we understand as "security" on this site, that is features that make unauthorized use computationally infeasible. Remember that original credit card was simply imprinted. There was hardly any security at all. Business security is another thing entirely. If the risk is high (as in credit card fraud) you can either put your money into bringing the risk down - or you can pay money to insure your risk. From your point (the customer) it's quite safe and very convenient - you just call your bank, tell them "I didn't authorize that" and they give you your money back.

There is also thief's point of view: the card number is useless if you have no way of getting value out of it. Booking a hotel with stolen card basically announces the world where and when you are. Ordering goods requires a delivery address - again the next person who knocks to thief's door may wear blue instead UPS's brown uniform.

Of course, everyone is doing their best to prevent frauds. Hence the SSL, certified payment processors, best practices recommendations and requirements, etc etc. But those only minimize risks of exposing your card number - once it's exposed, all bets are off. Just looking at your cards is enough to "steal" most of it. The rest is a balance between costs and risks.

Disclaimer: I don't mean that insurance is a "worse" kind of security. Even with crystallographic algorithms we are sure there is a way of cracking them, it's just not feasible (read: profitable) to do so. Business insurance is not much different concept, just the "cracking" barrier is lower.