The payment card system consists of two entirely parallel mechanisms, with different purposes.
One of them ("Authorization") is about verifying that the payment has been authorised by a cardholder, and is there to protect the issuer against fraud by their own cardholder and perhaps if you squint, to indirectly protect you from thieves. This has been the focus of technological innovation, up to and including EMV ("Chip and PIN"). It's also completely optional, most cardholders have no idea that's the case.
The other mechanism ("Settlement") is about taking money from the cardholder's account and putting it in the merchant's account. This is done entirely on the honour system, always has been, probably always will be, none of the technological improvements touch it significantly. It's mandatory in the sense that without it the merchant can't get their money.
Avis doesn't need Authorization to get your money, they only need Settlement. And like I said, it's on the honour system. Any merchant in the system can just tell the card network "Hi, card number X gave us $418.26" and they'll get $418.26 of X's money in their account. No need for any other steps.
Now, if you dispute the transaction the issuer _might_ say, well, wait, how do we know they agreed to pay $418.26? And then Authorization matters, the Authorization can prove somebody swiped a card, or typed in a PIN, or whatever. Without Authorization the issuer might choose not to pay. But there's no guarantee as you found, unless a government regulation forces their hand why should they care - it isn't their money?
This reliance on the honour system means that e.g. even though EMV has anti-replay features that mean Authorizations can't be re-used about once a year or so in the UK you'll have a news story where some big merchant like a supermarket or fast food chain will double charge all card customers for a day. What happens is the Settlement data just gets accidentally run twice, maybe it's a physical magnetic tape, or a backup copy of a file, or some new server boots up and re-runs yesterday's Kafka stream. Settlement has no replay resistance so even though all these transactions are duplicates that goes undetected until customers start phoning up angrily and their bank realises what happened.
To a first approximation nobody checks Authorization. If you wanted to be an asshole you could try it out, ask your bank to reverse a random fraction of all your transactions. When you get a bill, pick some at random, phone the bank. Insist those are bogus and you've never heard of them. In most cases the vendor has no usable Authorization records and will just write it off, they were entirely reliant on getting paid on the honour system. Obviously if you're unlucky you'll pick someone who can prove you owed them money and is angry about it, so you may not want to try this after all.
You might think this situation is crazy but it's more common than you realise. There have been a lot of grave problems with SSL/TLS over the years. But there aren't many examples of actual consequences in practical terms. Mostly it seems as though there actually aren't bad guys trying to break your secure communications, so even if it would be possible they didn't try. Huh.