it goes through a minimum of two requests to the zen cart server in the confirmation and completion processes. During these requests, anyone listening on the network would be able to see the user's CC information in plain text.
Exactly why you must have SSL for your site - I as a customer will not be entering my info on a non-secure connection...

I have not checked PayPal Pro Flow but others like Linkpoint require that you specify the htpps address - (need SSL to enable htpps:)