Wonder how they block the card, my impression was that tokenization was meant to make it harder for card chargers to be able to track a card through multiple taps like that.
TfL not only gets your Apple Pay device account number (DAN), but can also associate it with the primary card number (PAN). Both magically appear if you add the primary card to your online TfL account and have used the associated Apple Pay device with TfL before.
They must have the card identity because you have to explicitly 'tap out' at the other end, if you don't want to be billed with a maximum fare.