(And yes, it is idiotic. It replaces a magnetic strip scan (which, by the way, these cards have - which means that it's strictly less secure now, as it still has the problems with magnetic strip and the problems with NFC) with a plunk the card on the scanner - which doesn't save much of any time. And in the process means that your card isn't secure even if you have it on you at all times and use only trusted readers. Larger attack surface.)
They are trivially susceptible to relay attacks, among other things. (Plunk a relay near the target, and a relay near the thing to open, where each one sends any data it picks up to the other one, which re-broadcasts it.)
Note: any NFC card is susceptible to this sort of blind relay attack. As is any buttonless key fob (like the ones on some cars).
Theoretically, you can prevent this by means of speed-of-light limitations, or by requiring user interaction (like pressing a button on the card itself, for instance. Although even that could be abused). But in practice, they are too cheap to build that sort of circuitry in. As usual.