It's up to the merchant what level of verification they want. Some want to verify the zip code, some choose not to.

Just because some choose not to doesn't mean it's security theater. Every business makes their own decision based on the risks they feel are involved and the charges they pay for using a lower verification standard.