Yup, that's pretty much how Android Pay is designed. Unlike Samsung Pay, you only need your phone to be unlocked for Android Pay to work and to be able to make transactions (that, and well, NFC being on)m, which is why it forces you to have a secure lockscreen.