Your phone doesn't look for authorization from you before just giving your money away via an NFC transaction?
Or do you just blindly (and boldly) approve every box that comes up asking for authentication regardless of if you took an action that would require authentication?
The whole idea of NFC is "convenience" which is usually inverse to security.
Many cities allow NFC for public transport, for example. If you have to authorise every single tap-on and tap-off when using your phone to pay for the subway or bus. this is *not* convenient and I would expect that ~99% of people who use their phones for this job have the authorisation turned off.
Note that I am not suggesting that using your phone to pay for stuff like this is a good idea, just stating what I have seen other people do. I use the dedicated public transport pass, and add credit with cash to the pass when required. If I visit a new city, I get a new pass for that city's public transport. This way, if my pass gets stolen or hacked, the most I can lose is whatever cash was loaded onto the card, usually in the order of $20. No login details, no personal info. Bank and ATM cards stay in my wallet until they are needed at an ATM or to pay for good/services that allow me to insert the card.
When articles like this come up, I used to post a link to a live demo that was done at defcon(?) over a decade ago, when the presenter took a volunteer from the audience and removed some money from their NFC card by basically brushing against their pants. I'll see if I can still find this online, I don't think NFC has got any more secure since then, and the proliferation of people paying by phone has only increased the number of targets.
IIRC there's a limit to how much money can be taken from a debit/credit card (or its equivalent on a phone) before active authorisation by the card holder is required, usually somewhere between $20 - $100. I don't think this really improves security though. What worries me is NFC harvesting en masse in busy areas. Imagine a busy shopping mall, subway station etc, with a concealed NFC antenna in a briefcase, that grabs money from every card that walks past. How much money could that harvest in a day? Even if the limit on each card is "only" $20, if a thief harvests the money from 1000 passers by, that's twenty grand in a day. Easily enough to pay for the hardware, laundering the money, and a tidy profit on top. Then go to a new crowded area and do it again the next day. It's technically feasible and I have found zero published stats on how often this happens - they don't want the public to know how easy it is to make unauthorised charges to their cards.