When I ticked the box there was nothing about how lax their security is and their disinterest about it.

Paypal terms have always said that digitally delivered goods are not covered by seller protection, ebay stopped allowing the sale of digitally delivered goods many years ago and as with all updates to their policies you would have received notification of this.

Paypal security is not lax but many users are, if they allow their accounts to be hi-jacked or their credit cards and information to be cloned there is not a lot Paypal or ebay can do about it.