I have worked for 5 different companies that needed to be PCI compliant and every one of them will fully decided not to do certain things. Not all of them were even hard, a lot of times it was simply the person making the decisions just didn’t want too.
So that’s mine. Credit card security is not taken seriously but the vast majority of places that accept credit cards