They (and most good businesses) would prefer the majority of their customer base be able to get refunds and deal with order issues swiftly than have to jump through hoops to prove who they are. Certainly an SMS PIN or other authentication method would make it more secure, but there is no further customer benefit. The monetary loss to Amazon is basically a rounding error so why make things more complicated?