Because the world sucks. Many times, your cc provider will detect suspicious activity and freeze your account, but one of the common patterns of card theft is a validation phase followed by a "hammer it until it cries" phase. It's quite possible to have a few small charges show up on your account that you might miss because your overall bill seems fine. Usually, once the card is proven good, you'll get the lovely bill for a first-class flight to Qatar.
I agree that a cc user should not have to care about any of this, but people responsible for protecting your money are not so responsible.
But there isn't any need to invoke PCI or details about it in order to say "Card info gets leaked so watch your statements".
(And most people are fairly aware of the fact that card numbers are sensitive information; the newish thing here is a large retailer failing so spectacularly)
Remember when people were afraid to enter their credit cards online, so they would call a customer service rep and read it to that person over the phone?
The key piece to keep in mind is that the info on that little piece of plastic is never "safe".
If I were warning my mother, I'd just follow your hypothetical above. Of course, if the outcomes of these data breaches start including other identity theft, such as the "$50,000 twitter name"[1] hijack, more realistic phishing attacks, etc., then things are going to get interesting.
[1] Which is of course silly since the TOS specify that they are not to be sold.
