Upwork would presumably say that freelancers who don’t use the Upwork tool are deciding they’d prefer for Upwork to not be part of the transaction. In particular this seems unambiguously right for “service not delivered” chargebacks, where managing chargeback risk kinda requires being able to prove that the services were performed.
That's a pretty weird reading of the concept of the gig economy. Upwork clearly wants to own the customer relationship, which is why they do what they can to avoid being cut out of the deal. In a world where Upwork would be happy to be compensated by freelancers invoicing customers directly for work found through Upwork you'd have a point, but that is not the world we live in. Upwork processes the payments, and both clients and freelancers are aware of this and that Upwork takes a cut for providing the matchmaking and process services they offer.
Service not delivered is normally dealt with by services like Upwork through escrow like arrangements or review procedures where the customer will only pay for approved work. Upwork chooses the second method, which means they have all of the control they need to ensure that freelancers only get paid if they deliver, substantially reducing the risk of such chargebacks.
And if these do happen, then the problem, again, lies with Upwork and the fact that they choose a payment method that offers that possibility. They could choose wire transfer instead if they were concerned with customers charging back after approving the work.
It's not a one-sided problem. They could do wire transfers, but that would be a substantial cost for their client side users, since most (American) banks charge $20-30 for outgoing wire transfers. It's not obvious to me why avoiding chargeback issues should dominate all other concerns, as bad as it is.
I think the point is the insecure payment method was Upwork's decision (they don't even allow their freelancer to propose an alternative their own payment solution) as was accepting the stolen card; risk management of non-reversible payments has a cost too, but that's a decision Upwork made. The only security decision the freelancer made was not to use Upwork's spyware. Which would give Upwork valid reason to default to siding with the client over the freelancer in the case of a dispute about completed work, but not to demand a freelancer reimburse them because Upwork had chosen to accept reversible payments with a stolen card and couldn't easily recover funds from their client after the chargeback.
Apparently the cost of credit card processing amounts to $12.5K, on account of something that the freelancer could not have been aware of. The thing to watch for is whether Upwork improves their processes on account of this happening, changes their terms of service (supply side) changes their terms of service (demand side) or does nothing at all. That will tell you all you need to know.
