It's quite common for these companies to push their transactions through their US subsidiaries. If a company can convince their bank there will be little or no fraud they can convince their bank to avoid 3DS as well. E.g. if you have lots of transactions and other attributes keeping fraud low, like airlines who check your identity later anyway.