Blame the elected officials for forcing Valve’s hands. Valve effectively had these choices:

• Stop operating in Australia
• Not comply and pay fines
• Use CC as an indirect way to verify age (since banks are regulated themselves and do identify verification before issuing one)
• Do age verification (by themselves themselves or through a third-party) and put users data at risk in case of a data leak

To me it seems like they chose the least risky option available.