Why wouldn't "add in fraud protection since that's many people's reasonable default assumption" be the most desirable thing for them to do?
Why do we let people get away with such crappy ideas, and then just blame users or implementers (UI designers, in this case)?