Perhaps the thought is if they don’t understand the questions, then how can they be trusted to protect credit card data? Maybe it’s a way to ensure they reach out to someone that has that expertise, or to push them to services that handle the PCI details for them.