No idea. Lots. Paypal invests a lot in security. It's not reasonable to simply say, "if Paypal does X, it must be safe to do X"; for that to hold, you have to be putting effort comparable to Paypal's into security. Most startups don't, and can't.