I deal more with HIPAA/HITECH compliance than PCI/DSS directly, however, HIPAA also usually necessitates compliance with PCI/DSS. Why? You never know when medical records will contain a front and back photo copy of a credit card. More often than not, they do (sadly). This usually comes from someone just using their card to settle a co-payment. Everything just gets tossed in one folder.
Embarrassingly, when these records are 'digitized' by third parties, more often than not the resulting (unencrypted) databases contain clear copies of the CC info. Its not as bad as it was a few years ago, but its still a problem. The cause there is not carelessness, its cluelessness.
A few hospitals have already suffered from this practice, after records were stolen (physically or electronically), resulting in shopping sprees.
With any standard, a responsible company will look at the intent behind the standard and realize the problems the standard is trying to solve. This results (quite often) in exceeding the requirements of the standard. That is, if, indeed you realize that the standard applies to you :)
If you have a breach, just one breach and were dishonest about compliance (going back to your question), you will:
Never get another merchant account. Just forget about it. You may as well just close down shop, you have no way of getting paid.
Be hauled into civil court and have to pay damages
Possibly be hauled into criminal court with more serious consequences
Enjoy paying for identity protection for every effected person for years to come
If you were honest, and follow the rules about notification / etc, you will probably get out of it with a bit of a black eye, fix whatever hole was exploited and go back to business as usual. No system is, after all, 100% impervious to compromise.
You are probably correct in assuming that some companies do not follow the standard. If we assume that, we can also assume that they have been breached and just failed to report it deliberately, or perhaps (due to not complying) they did not realize the breach.
Visa / MC / Amex are very good at finding patterns, eventually they will trace a fraudulent trend back to a single vendor, and that vendor will be in quite a bit of trouble. The key here is notify them immediately in the event of a breach, which means following best practices. If they have to 'figure it out' and discover (no pun intended) that you are the common denominator, it can get quite ugly.