It may not be harming YOUR customers, but I don't agree with the premise that you only have an ethical obligation to protect the people paying you. The competitor's bad practice vastly increases their customer's risk of having their cards stolen, not only by people who break through the "security", but also by disgruntled employees.