I know from experience that similar setups tend to have the workstation load the verifone updates, so a package could be inserted, it would take some more insider knowledge.
In that case the risk of accepting malicious updates from insecure touch screen would be much less.