You are describing in-person purchases, but the discussion is about online purchases.
The EU+UK and Visa/MasterCard have different policies for these. Low-value [1] contactless purchases only occasionally require a PIN, higher-value in-person purchases always do, and online ones require the 2FA system linked above.
[1] https://en.wikipedia.org/wiki/Contactless_payment#CVM_limit