Dont get me wrong - its not a complaint! I'm just curious why they're not using one of the few particularly cool/useful things that Worldpay do (I work with it regularly)!
In terms of security - the callback method is pretty secure. You can do things like checking the referring IP resolves to a worldpay.com domain, the callback password must match... And even then, you can check the payment was valid too. Maybe even only accept ones where the full address matches?! Worldpay often marks transactions as ok even though maybe only the postcode was a full match.
[center]