Because some merchants are willing to take the risk and some are not.

Not sure how much clearer it could be.

it's up to the merchant what steps they want to verify on a credit card transaction. Some will ask for an ID with every transaction (even though in most cases their agreement prevents them from doing so) and some won't. Some will verify zip code and address, and some will not.

The assumption that just because somebody chooses not to do something means that that something is not effective is just silly. Some people don't have working fire alarms in their house, and their house has not burned down. Does that mean all fire alarms are useless?

Apparently, using the logic that some people can get gas without a proper zip code, yes.