I can tell you that Visa prohibits the bank from profiting from the chargeback process. That is, if a chargeback is filed, the consumer is not to be held to the Reg E liability amounts. Otherwise issuers may hold the consumer liable, collect from the merchant and take that to offset other losses or as miscellaneous income - obviously a counter-consumer protection issue. If the funds are collected after the fact, they would be repaid to a consumer who had previously been held liable for that amount. Similarly, we had Reg E fraud cases that we settled with the consumer and prosecuted through the county attorney. In the end if the perpetrator paid reimbursements, once the bank collected what the bank lost, the consumer was repaid the amount they had been liable for from future reimbursement payments.
On that, the liability in Reg E is under 1005.6 and "may" means that the bank can hold the consumer liable under certain circumstances, not that it must. Like all consumer protection rules you can always do more for a consumer, but never less. If the fraudulent charges did not use an authorized access device, the consumer has zero liability already. If Visa provides zero liability, you can do that for the consumer, but you can not do less than Reg E requires. To get zero liability Visa imposes certain requirements. If those are not met, no enhanced protections need be provided and the STAR network would be a condition in that, using your example.