> Isn't the fraud risk still generally born by credit card companies at the end of the day?
Absolutely not, the bank initiates a chargeback, which the payment processing network directs back to the one who handled the payments. They generally are then tasked with "proving" the purchase is authorized. Enough chargebacks, even fraudulent ones, and the payment provider cuts ties with you (although, at Google scale, I don't see this happening) as you're too great a risk.
> App review is a joke, the rating systems on both platforms as absolute trash and often gamed by publishers (remember Uber's in app prompt about how many stars you'd give them that forwarded you to the app-store if you gave them 5 and otherwise just offered you an internal complaint form if you gave them anything else? Everyone does that).
The implementation being a joke doesn't mean it's not a service with COGS that need to be accounted for.