I didn't look into it deeply, but from the law I could find, it appears that liability is only limited by law in the event that the cardholder never authorized the transaction.
For this particular case, the cardholder authorized the transaction, and just didn't get what he expected to get. Maybe that's covered by a different law I didn't find?
The Fair Credit Billing Act, a revision of the Truth in Lending Act, specifically covers this:
"(3) A reflection on a statement of goods or services not accepted by the obligor or his designee or not delivered to the obligor or his designee in accordance with the agreement made at the time of a transaction. "
Basically that's saying that if you ordered it, but the vendor didn't deliver properly, that counts as a billing error and must be handled like any other billing error - the credit card issuer must conduct an investigation, in writing, document everything, and can only bill the card holder for the amount in dispute if the card issuer is fully satisfied that the goods were provided as ordered. So the card issuer is in the business of adjudicating fraudulent disputes, whether they want to or not, which gives them a strong incentive (because they're going to be stuck with the fraud) to reduce and prevent fraud in the first place rather than passing it off to the card holder.
For this particular case, the cardholder authorized the transaction, and just didn't get what he expected to get. Maybe that's covered by a different law I didn't find?