It would just have had to accept buyer's money into its own temporary wallet (for example) for a period of time, or just block withdrawals of cryptos for merchants for a time, or in any other way, but it MUST have protected buyer's money in a way!
Otherwise, why is it needed at all???
The main reason that a merchant may use their service is if they do not have the technical knowledge to secure their wallet environment and properly implement an exchange rate for cryptocurrencies. They allow you to accept a bunch of different coins without securing all the wallets on your dedicated servers. That's attractive, since downloading and properly maintaining various wallets in a secure environment is one of the main deterrents to accepting smaller altcoins (e.g. because of malware concerns).
There are escrow services (even right here on this forum) if that's what you want. Basically what happened here is that you sent a payment directly to the scammer. Coinpayments doesn't actually control the keys here.