> Isn't the fraud risk still generally born by credit card companies at the end of the day?

Absolutely not, the bank initiates a chargeback, which the payment processing network directs back to the one who handled the payments. They generally are then tasked with "proving" the purchase is authorized. Enough chargebacks, even fraudulent ones, and the payment provider cuts ties with you (although, at Google scale, I don't see this happening) as you're too great a risk.

> App review is a joke, the rating systems on both platforms as absolute trash and often gamed by publishers (remember Uber's in app prompt about how many stars you'd give them that forwarded you to the app-store if you gave them 5 and otherwise just offered you an internal complaint form if you gave them anything else? Everyone does that).

The implementation being a joke doesn't mean it's not a service with COGS that need to be accounted for.

> Isn't the fraud risk still generally born by credit card companies at the end of the day?

No – for online/e-commerce payments, the liability is generally with the merchant, not the card issuing bank.

If it was about risk/fraud, debit cards would be an economic non-starter, as their interchange is capped to 0.05% + 0.24$ for almost all issuers.

EU issuers also get by (probably not too comfortably so, but still) with the recently introduced interchange cap of 0.3%/0.2%.

Nope. All fraud and chargebacks go back to the merchant/seller. The processor will immediately hold those funds in question pending a dispute or resolution around the fraud or chargeback.

On top of that there's a hefty fee for any fraud or chargeback that's not refundable even if it's resolved in your favor. Usually in the range of $40 per instance.