It goes something like this:
(Client): I want to add a shopping cart to my site. I heard that xyz cart is free, can you add that for me?
(Developer): Sure! That looks easy.
(Months and a couple thousand dollars later): Okay, I think it finally works, and is all hooked up, ready to go. I put an SSL certificate on your $15/month GoDaddy account and so now you're all safe and secure.
(Client): Great! I'll just check all the boxes on this PCI questionnaire and we're in business!
A few orders come in here and there, and all seems fine. At first.