Credit card companies can only do so much. Visa and Mastercard now require merchants to have chip readers, if a merchant only has a swipe machine, then that merchant becomes responsible for any fraudulent charges. So they would need to check IDs and signatures for all purchases.
I think this was Apple's way of saying they take responsibility for fraudulent charges, and third party App Store might not do this.
If a new app store starts accepting Visa, and there are 10,000 fraudulent charges, who is responsible for that money? Visa? the developer, the customer, the app store?