It's not my job to defend the payments industry - I think it's full of dinosaurs putting out bad code slowly - but I will say that the flaws here are not universal.
I've worked on the security systems for some reader/terminal devices that contain their own master keys in wipe-on-tamper memory, and use various key-derivation techniques to derive (and then immediately discard) per-transactions keys to protect transaction information, PINs etc.
So it's not all as bad as this. However things like ISO-8583, better described as a protocol family or meta-specification than a single protocol, probably are rife with poor implementation choices.
Here's the post by the researchers themselves: https://srlabs.de/pos-vulns/
tldr: POS card readers have poor security - their HSMs leak their keys, and many of them don't have unique keys so you can impersonate them