The developer wouldn't be on the hook because Steam is the one handling payment processing. If they don't handle CC fraud and just pass the buck to the developer who happens to be the one whose game was purchased fraudulently, that sounds like a pretty serious problem with Steam IMO.