In the end, your CC info isn't actually transmitted over the internet. Just a transaction ID and biometric ID is used. Remember how many companies are reporting breaches in payment servers?
That was a pretty well written article that I think should be shared in every thread related to ApplePay because most people can have they're questions answered from there.