So this appears to be by design. If you have a password, pin, or fingerprint protected lock screen and you use the camera from that locked screen, technically one could gain access to the touchless payment software. It's like the camera isn't sandboxed so that's their solution.
You can get the...