This risk also applies to any card terminal where you pay contactlessly. In Europe, that effectively means every card terminal everywhere and a comfortable majority of card transactions (https://www.mastercard.com/news/europe/en-uk/newsroom/press-... says 75% of mastercard transactions in Europe are contactless).

The main protections against this are maximum limits for unverified contactless purchases (about €50, depending on the country) and banks outright guaranteeing customers against fraud (https://europa.eu/youreurope/citizens/consumers/financial-pr...).

No idea how that can translate directly onto phone-based terminals though. On cards, the extra-validation backup for suspicious/over the daily limit transactions is that the contactless machine asks you for your pin, but there's no way anybody should be typing their card pin into a random stranger's iPhone.