The problem with 3dsecure is that it's still driven by the merchant. If you see it, you can be pretty sure they're doing something right, but if you don't see it then you've just given them your payment details and have no recourse.

Many just don't turn it on because it's another step and they don't have issues with fraud, as well.