The thing is, upwork in this scenario did not vet whether client was the actual owner of the card he was using to pay creators, this is a fault in upwork's fraud detection algorithm, their freelancers should not have to pay the penalty for this.
Upwork takes a 30% cut (or lower, depending on your income on the platform), they are taking this cut, to create a safe and trust-able environment for its users by verifying both clients and freelancers. Considering this incident is a lapse on their end, the penalty should be paid solely by them.
If doing so means they will go bankrupt, it just shows they failed as a company to create a safe enough platform to justify taking that 30% cut.