So as usual the actual problem is how terrible banks are
Blaming the banks here is akin to blaming the postal service because they delivered a bomb.
This raises the bar for theft and fraud significantly compared to the credit card system, where a simple copy of the numbers on it is enough to take any amount you want.
However, almost everybody I know never uses credit cards to buy anything. Everyone I know uses debit cards. With the rise of contactless payments there's an argument to be made that those are still usable, but it only takes a quick call to your bank to disable that.
All Dutch banks I've seen used online require at least SMS 2FA. Payment through mobile banking apps often do not, but the process of authenticating your phone with your bank is very cumbersome even for legitimate use. In my local banking ecosystem, digital fraud only really exists in the form of phishing. I don't think I even know anyone who's ever done a chargeback.
The credit card system is horribly designed and because of compatibility reasons (and fear of change) fraud is much more common than with banking like I'm used to. I use my credit card as backup on holidays and for paying on some foreign websites but I never feel at ease entering my card details. It's ridiculous how in this day and age credit cards are still so easy to abuse.
Why? Here in America CCs give fraud protection. Debit cards only after the first $50 after a fraud charge. Banks almost always reverse CC charges.
Because Europeans are weird about this, there isn’t really any reasonable explanation.
You can absolutely use a credit card online if you get the card number, date and those last three numbers on the back. No need for a pin there.
You can even use a stolen credit card these days in physical stores, because of the Contactless Payment on most new cards. As long as you don't spend too much, you won't need the pin.
Sane solution? For merchants, maybe. For consumers, no.
Authorisation is the system which verifies that you, the card's holder, authorised this payment. This is the part that EMV ("Chip and PIN") and lots of anti-fraud technologies are focused on, and yes its main purpose is to prevent you (though also the merchants) from defrauding the bank or other card issuer.
Settlement is the system which transfers money from your account to a merchant's account.
Authorisation is optional. If there is zero authorisation a settlement will still work, though there is some higher chance either the card holder later disputes it or the issuer decides it was fraudulent by their own methods.
Big merchants often just don't use Authorisation at all. Whereas if they didn't do Settlement they wouldn't get the money, not doing Authorisation just means it's harder for them to "prove" you agreed to pay, but they may find it just isn't worth fighting you anyway.
Knowing this you should read your card statements every time they're sent, in proportion to how careful you need to be about money (if you're Elon Musk maybe don't sweat any line item under $1000) because that's the first time you may find out that, for example a hotel in a country you've never visited has submitted Settlement data taking $500 for a hotel room you never booked. Mistake? Fraud? Who cares, if you don't spot it then you're out $500.
Yes banks may tell a jury in a fraud trial (against you, their customer who has been stolen from, convicting you of fraud means they aren't on the hook for the missing money) that only you should have known the PIN and therefore the jury should assume that your inability to explain how "someone else" had the PIN means you're lying. You will need a good lawyer and experts to explain that actually the bank's insiders can know the PIN (the bank will try to dodge this awkward fact, insider fraud at banks is common and banks would prefer you never think about that) and there are various means by which it could have been stolen that the bank doesn't do enough to prevent.
When EMV ("Chip and PIN") was introduced the main increase in fraud went like this: You hide a skimmer inside the PIN terminal, and it harvests card details (it could also harvest PINs). The terminals are supposed to have "anti-tamper" systems to defeat that, but they're trivially bypassed. Now, you can't use these to make EMV cards, but you can use it to make a convincing fake non-EMV card, and then use it in countries that haven't rolled out EMV.
This fraud mostly went away as more countries finished deploying EMV but other types replaced it. Some of these things are only possible because EMV is a typical "Hand rolled crypto" solution where nobody remembered to hire actual expert cryptanalysts to critique and revise the design before it shipped. Others aren't technical at all.
Hell, even having disposable credit card numbers that were locked to a single merchant upon first use would basically eliminate card fraud.
There are N+1 ways transactions could be improved, and each one probably has many reasons why "it can't be done". I don't feel like getting into all of that though, because it would take forever.
Does that also apply to online purchases?
What I don't understand is why banks and other financial organizations keep retaining G2A as a customer. Surely they must have hundreds if not thousands of cases involving G2A by now.
Merchant services providers do need some fees to accurately process chargebacks, and in the normal case it also functions as an incentive to make sure you perform transactions that you reasonably believe won't be reversed.
I imagine G2A is using a more fraud-friendly payment processor.