The problem is many merchant will not become PCI Compliant.

All merchants are at risk for having sensitive data, such as customer card data, compromised. Although nothing will completely eliminate your exposure to the theft of this data, your compliance with PCI DSS will help reduce your risk significantly. Part of the T&C of becoming a merchant who accepts credit card is becoming compliant. Failure to do so is breach of contact. No matter your size, you’re required to properly handle credit and debit data and ensure it is not stolen and used for theft and fraud.

However in the event that something happens, because they are PCI Compliant then they are able take use of their Data Breach coverage which porvides them up to $100,000.00, forensic investigation, credit card re-issuance fees, punitive fine from the credit card brands, and ADCR expense resulting from fraudulent credit card use.

Also merchants that are PCI Compliant also have The Visa Global Compromised Account Recovery Program (GCAR) and enables issuers to recover a portion of costs associated with counterfeit magnetic-stripe losses and/or PIN data fraud losses, as well as a portion of the associated operating expenses, for qualified account data compromise events. The program also limits liability of merchant banks for fraud costs associated with a data compromise event to a maximum window of time and further caps losses associated with operating expenses and catastrophic liability losses..

The PCI questionnaires can be a bit lengthily but the negative impact to the owner's reputation and the business' reputation is more costly than the time it takes to become compliant.