I think the point is the insecure payment method was Upwork's decision (they don't even allow their freelancer to propose an alternative their own payment solution) as was accepting the stolen card; risk management of non-reversible payments has a cost too, but that's a decision Upwork made. The only security decision the freelancer made was not to use Upwork's spyware. Which would give Upwork valid reason to default to siding with the client over the freelancer in the case of a dispute about completed work, but not to demand a freelancer reimburse them because Upwork had chosen to accept reversible payments with a stolen card and couldn't easily recover funds from their client after the chargeback.