They don't do that to ~25%(!!!!) of customers. You can't continuously run an above the table business involving card processors if even 1/10th of those people do a charge-back.
That 22% is a lifetime figure, not a per-occurrence figure. I've had my credit card info stolen several times, yet the fraud rate per transaction is way below 1%.