> As far as I know, the merchant always bears the full liability for fraud, whether you use 3ds or not.

This is very much untrue. If a merchant initiates the 3DS flow, liability for fraudulent transactions shifts from the merchant onto the issuer. Here's documentation from Stripe[1] on the matrix of possible flows and the resulting liability shift, and docs from Adyen[2] on card networks that support liability shifting with 3DS.

[1]: https://support.stripe.com/questions/liability-shift-post-sc...

[2]: https://www.adyen.help/hc/en-us/articles/5091186681500-What-...