I'd say yes. I don't question Grossman's concerns, they are real. PCI DSS, or some other regulation, needs more teeth, but at least these merchants are calling in WhiteHat Security and other approved scanning vendors (AVS). Would these merchants who are more concerned with thin margins in retail markets than credit card security take it upon themselves to spend more on security? The merchants concerned with protecting brand value would but I doubt small and midsized merchants would be so ready to spend on information security. I'd bet they could rationalize spending on physical security to protect inventory, but our credit card data is another story.

I think Rich Mogull of Securosis makes an important point late in the eWeek article:

Give credit where it's due, at any rate: PCI is improving security, warts and all. "It is at least forcing companies to take another look at security," Mogull said. "I may complain about PCI but if they have to pass it to improve security it's good for consumers. And shareholders, and business."

The current version of PCI DSS is a start. The next version should clarify vague areas and specify responsibilities for fixing vulnerabilities and consequences for failure to do so.