Just re-read what you've posted. The answer is there: When you use your X bank card, the bank knows and shares your purchases. When you use Google Pay with the same X bank card attached, in addition to the bank, Google knows and shares your purchases. More on reddit.com

So you can set whether Google Pay needs the phone to be unlocked to pay, or whether you can pay with a locked phone, that's up to you. Additionally if someone stole your phone and you're and the phone needs to be unlocked to pay the thief would need to keep your phone unlocked to be able to pay with it, this would mean interacting with the phone every minute after stealing it and never touching the sleep/wake button. A thief is more likely to be interested in the phone itself rather than the Google Pay account on it. Also (in the UK) there's limits on NFC payments of no more than £100 per transaction to limit such transactions after theft. I also believe banks are instructed to repay amounts to the customer when a card is cancelled due to theft and because of the £100 limit they're likely to do it as they're not on the hook for like a £3k purchase. Also if your concern is theft resulting in stolen funds then any contactless debit/credit cards are a much bigger security risk for this than your phone. I think my current setting is to pay when unlocked, because I'm honestly not worried about the scenario you mention. I'll get the money back from the bank. And a thief isn't likely to spend money on my phone, that's just leaving a trace to a business where they can be caught on CCTV. Once they've stolen my phone their main prerogative will be to sell it immediately and pick up more money than they're likely to spend contactless. Also on the accidental payments thing I've seen mentioned. I've used versions of contactless phone payments for about 7 years maybe? I've never had this happen once. I wouldn't worry about this. More on reddit.com