I'm more referring to an attacker cloning their own cards, not someone else's. Some smartcard systems assume that the state of the card is the source of truth, and not anything on the server. In that case you don't want people cloning their own cards and then using those to hop on the subway.

I don't see the argument for why security requirements should be lower in that case. Security cameras are not always present and getting arrested "on the spot" for a virtual card theft seems unlikely given the nature of the crime (it seems doubtful police forces would have officers standing by for this purpose that are able to both detect and react quickly enough).