> In the line of sight of victim

Yeah, you can actually check out the details in https://www.emvco.com/specifications/contactless-specificati... -- relevant parameter is "Device Estimated Transmission Time For Relay Resistance R-APDU", which is specified as "typically 1.5ms".

That's already hard to achieve reliably (in-store WiFi is right out, but possibly Bluetooth?) but would definitely make the required on-device malware even more complicated...