If the business simply doesn't offer click-to-cancel, so you haven't actually canceled your subscription, how could you successfully claim the payment was made fraudulently? The law doesn't mandate that you can unilaterally exit any agreement, it mandates that businesses have to offer an easy way for you to do so.

The example of a yearly subscription paid monthly should make this obvious. You can't exit this arrangement after 6 months and expect to simply not pay the remaining 6 months, as the contract was for a whole year. All this law does is force the business to make it easy for you to cancel any auto-renew for a second year. But if the business doesn't do that and you dispute a payment, how hard do you expect your bank to work to figure out if this payment was for a part of the original contract, or for an auto-renewal you should have been able to easily canceled, but haven't?