[randyrand]

The attack vector basically requires a stolen iPhone.

If instead the card itself is stolen, I can understand why they think this exploit is low priority. It’s the same security model people already expect. Physical card = anyone can use it (assuming no PIN)

Might as well fix it though.