And majority of these would be secured via on device biometrics.
The fact that this is all happening with approval of credit card companies, banks, regulators etc means that the idea that centralisation is fundamentally flawed is simply wrong.
If there is a vulnerability, who pays for fixing it? Who pays for the new phones?
Of course the credit card companies and banks don't want to be responsible. They currently aren't, and they don't want to take it on.
Why should the regulators care yet? Using a mobile phone is still under the fiction that it's an optional functionality, where the user has agreed to take on the risk themselves, in exchange for better convenience and non-essential services.