Case in point, did you know if you only had the card number and expiration date of a stolen card, you can keep retrying the CVV code until you guess it when registering a card with Apple Pay? (it's only 1000 codes to try)
Android Pay and Samsung Pay both have gating tech built into their apps to prevent this. Apple Pay does not.
Sounds like an easy fix, but it's a security flaw that has been there since Apple Pay was launched.
To add a card to Apple Pay you need to confirm it with the bank via phone call/sms. So even if you know all the details of the card you can't just add it to Apple Pay.