Still used in Windows IT environments as it's portable, even if it is a bit slow and there is no console version for generating tree-maps for remote viewing.
In my experience large Microsoft customers deployed applications with SCCM, now perhaps moving to Intune. Distributing MSIs via group policy is fairly primitive compared to what endpoint management platforms can offer.
But my point was that large commercial installer kits were always required to produce MSIs, in the absence of something like the WiX Toolset.
I'm wondering how much of the frustration in the comments here is due as much to the arcane design of the Windows Installer format as to shortfalls in WiX and its documentation. I would say that you need a good understanding of MSI databases before trying to use WiX, which implies thinking about the installer while developing the app, which was the goal of the toolkit.
Packaging can be hard on any platform but Microsoft really outdid itsself with MSI. If you already have a finished product and just need to package it then NSIS or Inno were much simpler to pick up.
Many products are released as MSI files because that's what enterprise deployment tooling supported, but inside is a setup executable, which defeats the entire transactional rollback design of the thing.
When Microsoft launched the (let's face it, baroque) complexity that is Windows Installer (MSI), we didn't get the WiX Toolset, instead we got an expensive proprietary profiling tool for capturing before/after snapshots, and an entry-level version bundled on the Windows 2000 CD which didn't really solve anybody's problem. No suprises then that the MSI format didn't immediately take over, and Microsoft would presume all the way to Intune that their customers were deploying MSI packages when mostly we weren't.
I always wondered what would have happened if the WiX Toolset had been available from the start, and I like to compare the more organic success of the Microsoft Deployment Toolkit (MDT) being more open and hackable as an example. I guess the time just wasn't right.
Isn't the licensing an issue? As far as I can tell you can't use Obsidian at your workplace without an annual commercial license, which is fair enough but maybe too heavy a lift for many.
Not really familliar with PCI DSS but it might be that the card-readers/terminals aren't PCI-compliant if opened? So not the manufacturer's issue but the customer's.