Isn't it possible that malware which found its way onto the phone could skim off the data as its being swiped? This is entirely different than a typical physic

Isn't it possible that malware which found its way onto the phone could skim off the data as its being swiped? This is entirely different than a typical physical skimmer, as the person swiping the card for entirely legitimate reasons is likely unaware of the malware, and would be as much a victim as much as the cardholder. From what I understand, the Square device does not encrypt the data sent to the Square app, making it easier for malware to capture transaction data as its processed.