Debit cards and credit cards can also be used without your consent if the employee doesn't take care to check it's actually you who owns it. Apple Pay, to my knowledge, requires your phone to be accessed. Much more secure if you have Touch ID enabled. I'm not positive that it only works with Touch ID as it's not available in the country I'm in.
Apple Pay requires use of the TouchID sensor, even if the phone is unlocked.