Apple probably requires fully authenticated bi-device on-line transactions making the risk much smaller. The EMV part requires the merchant device to be online

Apple probably requires fully authenticated bi-device on-line transactions making the risk much smaller. The EMV part requires the merchant device to be online or the process won't happen and the phone part requires user authentication; you'd have to break both at the same time to abuse it. Probably still possible, but much harder than stealing a card and using it until you hit the limit or get flagged. Probably also why EMV contactless without PIN and EMV contactless with PIN have different limits (amount of transactions and transaction amounts).