I was surprised when I first learnt that you could spend money online with a VISA card by only card number, expiration date and a 3(!) digit CVV. Those are hardly secure and printed out on the card that anyone can see. Then the US merchants have so many rules about fraud detection but all of them are just heuristics with many false positives and false negatives.
When Internet companies constantly invents new methods to both increase security and usability (two step authentication, pass keys, FIDO-U2F), the payment industry in the US is just stuck in the past.