Yes, those pesky regulations. Now you have to have a several exit doors if you want to open a nightclub. It keep it for the rich people.
Similarly, if a food truck uses a point of sale service, the food truck owner should not also have to be knowledgeable about evaluating the point of sale’s database security. Their job is to make food.
If the government wants to protect people’s data, then it should set the standards or certifications for the vendors (and/or go after the people who misuse the data), not lay that liability on the vendor’s customers.