Smartphones are largely available and relatively cheap. As these are produced in massive quantities, unit prices are coming down. In parts of the developing world, sub-$100 androids are sold, for instance.
For security, the user has to enter is passphrase (much like he would enter a PIN with a credit card).
You are missing the next step. The vendor's card reader was hacked by Bob. Minutes after the customer leaves the store, all of the keys from the wallet.dat were used to spend the reaming balance of the wallet.
So that specific approach won't work.
There have been a number of approaches. Here's some discussion on the topic:
- https://bitcointalksearch.org/topic/bitcoin-smartcard-point-of-sale-terminal-7539