How does these PoS systems get infected?

It is uncommon to search web pages or receive emails on Pay terminals. So USB? (not very effective?) or not updated system -> exploit?