> They can hold onto it, and never return it. They can deface it. All of that is a possibility.
But they can't potentially look at your banking app, read private notes, messages and emails, operate your home automation, look at your calendar, etc. if all they have is a plastic card.
They can't do that either with Wallet items. That's kind of the point: you can hand over your phone with a wallet item "unlocked" and visible on the screen, and that's all they'll have access to.
Sure but then you've already given them your phone after which you don't know what happens. Plus it's a lot of leverage for them to have it, e.g. "unlock or you won't get it back".
But they can't potentially look at your banking app, read private notes, messages and emails, operate your home automation, look at your calendar, etc. if all they have is a plastic card.