You know the same way you know that any card reader the merchant is using doesn't clone your card or misuse your payment details: you don't know at all.
It's possible for apps to detect whether the phone has been rooted or not, so one might expect that a payment app would refuse to work on a rooted phone, just like some video streaming apps do. But as the consumer, it's not possible for you to verify the security of the merchant's card reader, whether it's a smartphone or a special-purpose device.
The good news is that it's not your responsibility to do so. If the merchant allows your card details to be misused, whether deliberately or through negligence, they'll get into trouble with their merchant acquirer (i.e. their bank). You can "dispute" any fraudulent transactions with your bank to get them reversed.