The fact you can trick the NFC system on the phone into reacting to “phantom” payment events and intercept the resulting token sounds like a pretty big problem.
That’s not what’s happening though? It’s relaying a physical card’s nfc not tricking mobile contactless payments