It comes down to what Square are trying to do, if they want to be "another credit card reader device" then this isn't a security hole. On the other hand if the

It comes down to what Square are trying to do, if they want to be "another credit card reader device" then this isn't a security hole. On the other hand if they want to take the PayPal approach and build a secure payment brand which says "we're a securer way to pay because the end merchant never sees your credit card details", then it is a security hole, because it means you can't trust the Square brand to act as a layer between you and the merchant.