They're set at whatever the payment networks can get away with. There's nothing that says that's good for anyone else, although it is very good for Mastercard and Visa.
A better way to look at these networks is to understand two things: the first is that at one level, they’re an insurance business that makes a profit from insuring against fraud, and reducing fraud would reduce the profit margins they can make from that business. And a second way to understand them is as guardians of a hugely profitable network portal that’s very hard to compete with, and they’re charging as much as the market can bear for that service.
EU partially solved this with PSD2 enforcing two factor authentication for online card purchases.
https://finance.ec.europa.eu/publications/strong-customer-au...
I think some interpretations of the PSD regulations call for specific "after X euros of spend/Y transactions you have to explicitly challenge" but it may vary by country.
MasterCard and Visa are more like clearinghouses. The decision makers are their members having "access to the rails", issuers and processors, which are either banks, subsidiaries owned by banks, or companies sponsored by the aforementioned two (which very often includes one or more banks getting an ownership percentage).