It's up to the merchant; since in the event of fraud they'll be the ones who get hit with the chargeback, it's up to them to decide if they want to require that extra safety or not.

For a recurring subscription, the cvv was verified at the beginning. Cvv is for verifying the card security, not vendor account management.