Mobile payments are only as secure as the wallet service is, and Apple Pay is not doing the best of jobs to protect consumer data.
Apple is not alone. A lot of consumer data is terribly protected. There should be better laws for consumer data protection.
Think about it, if the criminal is carrying that device around they are constantly feeding that information back to Apple. It has been proven that various GPS tracking applications or even phone tower pings can easily track the geographical location of the phone. That is some pretty useful evidence when trying to track down perpetrators and you can connect the dots with CCTV. It's a pretty useful crime fighting combination but it comes at the price of no privacy.
Criminals are expert on technology, I am sure they can circumvent these things.