[wowokay]

I know from experience that similar setups tend to have the workstation load the verifone updates, so a package could be inserted, it would take some more insider knowledge.

[Too]

Do these payment terminals have secure boot or other forms of update payload verification?

In that case the risk of accepting malicious updates from insecure touch screen would be much less.