Banks do this because if someone entered wrong CVN, there's a good chance that it's stolen card info and person didn't have CVN. So bank rejects it because it's risky. But our bank allowed us to make CVN optional (like Amazon/Uber) to support the one-click flow. So if no CVN is sent at all, bank sees that as less risky than a wrong CVN.