Can Expresso do these things?

I lead Development at Vector Media Group, which owns CartThrob. I'm clearly biased in my belief that CartThrob is the better product. That said, I can answer your specific functionality questions as well:

cart must be easy to make PCI DSS compliant

You're certainly able to have PCI compliance using CartThrob. Many of our clients do, and CartThrob does what it can to help in this regard. Obviously a lot of the PCI compliance steps will fall onto your setup and server regardless of what commerce software you use though.

Must have selectable product options and oddly, must be able to sell even if stock is zero (third party will fullfill the orders and we don't have their stock levels but they're on the ball so they tell us).

CartThrob can do this. You can set the rules for when and how a product is allowed to be sold regardless of its inventory status. And if needed, you can use CartThrob's extension hooks to customize this even more.

And lastly do either of these two carts have import products facility/functionality. If not would it be simple to write my own using PHP or should I not mess with DB directly?

Because CartThrob stores product information in regular ExpressionEngine channel fields, you can import product data the same way you'd import any other channel entries. If you don't want to mess with DB/PHP, there are two add-ons which can help: Solspace Importer and DataGrab.

Let us know if you have any other questions!