... Not much agencies can do about them....
That's just not the case.
First, the agency can be more careful about verifying new accounts. Might cost the agency a bit more in staff and time, but doing a terrible (and cheap to the agency) job just leaves the contributor as the lone victim. The customer has the image (even without a license, but in practical terms that's usable unless the agency actually did any kind of follow up for use of unlicensed images).
Second, the agency could easily choose to bear the loss - as Shutterstock did for years - as a cost of doing business. That's why agencies get the majority share of the buyer's money.
Given all the other moves Shutterstock has made, it's clear their main goal is keeping profits up and making investors happy; spending money on doing a good job with security and credit card transactions doesn't fit that goal.