My bank has provided me with a swipe card, which must be used for all online transactions. As long as I have used it (impossible not to really) I am not responsible for any fraudulent activities on my card.
Another credit card I use asks me for my secret word whenever I use it online - this is a bank popup, not the store. If I don't use the validation word, I can't pay.
If some companies can take these measures - they all should.
If it worries you, buy the protection.
But check the small print of both the protection plan and the cards you have Lloyds TSB, for example, guarantee you won't be liable for fraud if you have taken reasonable precautions.