The attack vector basically requires a stolen iPhone. If instead the card itself is stolen, I can understand why they think this exploit is low priority. It’s

The attack vector basically requires a stolen iPhone. If instead the card itself is stolen, I can understand why they think this exploit is low priority. It’s the same security model people already expect. Physical card = anyone can use it (assuming no PIN) Might as well fix it though.