Because it is a security feature specifically designed for Card Not Present transactions which includes both telephone and internet. Security is not a binary perfect/useless outcome. If the code reduces fraud by any measurable amount policy can be established by comparing that savings to the implementation cost.