There are two dangers here: 1. This actually does lead to a breach of card numbers, in which case Square will face penalties from Visa/MC/Amex - those penaltie

There are two dangers here: 1. This actually does lead to a breach of card numbers, in which case Square will face penalties from Visa/MC/Amex - those penalties can be huge because they are calculated based upon the number of cards that were compromised (check out Heartland's breach last year). 2. Verifone is able to convince Visa/MC/Amex that Square is not PCI compliant and that they should fine Square out of existence (it's not a legal thing, it's at Visa/MC's discretion). #1 is somewhat likely, on Android moreso than Iphone, there have been android viruses before. #2 isn't that likely, unless there is actually a breach and it ends up costing Visa and Mastercard money, Square is strategic to Visa and Mastercard because it gives them access to an entirely new customer base (that Verifone hasn't had any luck with). 1. Customers don't give a shit. We hand our cards over into insecure situations all the time without thinking twice. 2. Businesses don't care either - they only care about PCI and security when either their acquirer (in this case Square, which won't do it) or Visa/MC start fining them or threaten to shut them down.