So this appears to be by design. If you have a password, pin, or fingerprint protected lock screen and you use the camera from that locked screen, technically one could gain access to the touchless payment software. It's like the camera isn't sandboxed so that's their solution.
You can get the best of both worlds by only using the swipe camera when your screen isn't hard locked, only soft locked. In my brief testing that seemed to work as expected.