It's the banks problem, to be frank. If you're in the US, your liability for fraud is capped by law at $50 per card.

I don't. But even if I did, I wouldn't have much use for it as I use single-use debit cards generated via my bank app or TatraPay (my bank's instant method of QR code payments) if the merchant has that option. I just wish there was a universal method for instant QR code payments. It's pretty convenient.

If you have malware on the machine it could just steal it when you use it the next time.

I simply do not use this feature.