Banks and card networks will only accept proprietary shitware as payment. Would you rather keep the malware confined to a separate processor chip or would you let it run on your phone?
In other words, would you like to have your physical card to be lost or stolen and someone paying with it? As small amounts don’t ask for a pin confirmation. Having my phone stolen is pretty much another level of attack.
Yes... that $25 if they manage to get even that before it is blocked I can live with. Loosing my phone, even if they can't do anything with it is a whole other scenario. Now I can't even get home.