Like email and spam, fighting creditcard fraud is a cat and mouse game, with technology and processes constantly being developed to reduce fraud. The CVV on the back of the card is just one more layer of security.
Requiring the CVV generally requires you to physically have access to the card. CVV should not be stored by any merchant. This frustrates card skimming fraud as the CVV is not present in the track data and fraud caused by database compromises.
You should never use your PIN online. MC/VISA both have implementations of 3D-Secure (SecureCode for MC and Verified by VISA) which require a password / code to confirm card ownership. Depends on both Issuer and Merchant implementing the standard.
Regarding not needing a PIN at the airport, some low value transactions no longer need PINs, depending on the Issuer and Scheme (VISA/MC). MasterCard PayPass or VISA PayWave enable low value contactless transactions without PIN. In Australia, the maximum value for a contactless transactions is $100 AUD. At some merchants (McDonalds for example) a PIN is not required for for meals purchased with VISA (at least, for the cheeseburger I bought there as a test). This makes sense - if you don't need a PIN for a contactless purchase, why do you need it for a chip based purchase?
So - why allow PIN free transactions? On average customers report stolen credit cards / wallet very quickly and the losses are correspondingly small. As card issuers are always online, cards can be cancelled very quickly after being reported lost / stolen.
Finally, by performing transactions for just a few cents or pennies, the merchant (Spotify) can likely validate you are the owner of the card as you'd need access to your online bank to confirm the transactions. PayPal do this with bank account to confirm ownership. (Unless I've misunderstood your statement).