Please note that RISC OS proprietary formats, are not that difficult to unravel. Squash is standard LZW compression, a sprite is a simple uncompressed bitmap, and text in a drawfile is stored as ASCII strings in the file (unless converted to paths). I have on a couple of occations in the past submitted my details by drawfile, but all the text was hand drawn lines (using a graphics tablet and Artworks free hand mode), which is probably beyond effort threshold for interception.
However while doing this was just about acceptible for small companies more than 5 years ago, it certain isn't today when there are a number of payment brokers offering secure online systems (paypal only being one), which are also able to accept foreign payments. The ARM Club has been using [link] for a number of years for online DiscKnight purchases, and they have performed flawlessly handling payments, and working with RISC OS browsers.