As an advertiser, CPM is fine too because if you're at all competent and do some basic testing you can build an above-average engagement ad and effectively get a discount. If your ad produces 10% more clicks than everyone else, you can bid more to get the same ROI. This is often easier than you'd expect. I buy all of our Facebook ads via CPM because we've figured out some great ways to get higher click throughs, and roughly what CPMs you need to bid at what times for what demographics and keywords to max out your budget as efficiently as possible.
Also, all advertising is basically CPA-by-proxy so it's not really that relevant to the advertiser whether they're paying by CPM, CPC, or CPA. When I buy an ad somewhere (as I frequently do) I may pay CPM, CPC, or CPA, but I'm simply converting them all into CPA in a spreadsheet because that's the way to get ROI which is the only thing I care about. If I have to spend 50 cents to make a buck, I'm ecstatic, but if I have to spend $1.50 I look elsewhere.
If the publisher uses some shady page-view enhancing technique that doubles page views but doesn't impact clicks at all, that's fine. I just will end up paying half the CPM (or moving elsewhere) because that converts to the same CPA in the end. The market values ad slots in terms of pseudo-CPA, so the publisher can't really boost their revenue in the long run without boosting the advertisers'.
All shifting from CPM to CPC or CPA really does is switch the party taking the risk from the advertiser to the publisher. It's pretty easy to see why publishers don't want to do that. Advertisers really don't want it anyway because it's harder to budget when you don't know how much you're going to be paying today.