The Verifone MX800 series, at least, can have Customer-supplied binaries installed. There's code-signing on the MX800-series devices, but I am aware of at least

The Verifone MX800 series, at least, can have Customer-supplied binaries installed. There's code-signing on the MX800-series devices, but I am aware of at least one version of the firmware that allows an attacker to get root access on the device pretty easily via the touchscreen UI and Ethernet port, assuming that default passwords aren't changed on the device.