Yes, that is in fact a security gap that can be (and is) exploited. In Europe at least, they bring the payment point to you and you place the card yourself (or ask you to go to the register)