If they baked the server's public key into the device and encrypted data with that, then only the server would be able to access the raw card data. This would prevent the device from being useful for anyone but Square. It may not be worthwhile to do so, but it certainly isn't the illusion of security if your concern is accessing the raw data.