Not only is it low-range (~2" in my experience), at least in Android the phone has to be on+unlocked before NFC is on. The only realistic route for this attack

Not only is it low-range (~2" in my experience), at least in Android the phone has to be on+unlocked before NFC is on. The only realistic route for this attack is a compromised NFC device (such as a payment terminal) that your victim would be using anyway. For that sort of effort, compromising a Wi-Fi hotspot would likely be more effective in terms of reach.