They didn't "steal" it from anyone. The contract the retailer signs with the merchant bank that lets them accept credit cards spells out whose responsibility it is. If you don't like it because you want to put the burden on customers, well, that's your issue, but good luck building a viable business beyond the tiny scale.
Yes I don't like it; enter Bitcoin.
Why should the merchant cover both cost of the transaction (the 3-5% transaction fee) + the cost of the customer getting their card stolen.
Credit card companies and merchants agree up-front that it is the responsibility of the merchant to verify that the person using the card is the person who owns the card. Of course, merchants are going to get ripped off. We get kids using their parents' cards. We get fraudsters buying digital goods (so no delivery signature is required) with stolen card info. It happens. It's a cost of doing business absolutely no different than the similar cost that restaurants have for broken dishes or corner stores have for shoplifting.
And how exactly (seeing as you are such as long time merchant) would you suggest that we "verify that the person using the card is the person who owns the card" with online purchased?
Currently merchants are forced to accept these shitty "contractual agreements" because they is no other option. Now there is another option.