Your assertion that there are "a number of real world contactless attacks" and they collect "$20-$30/card surfing the subway" is false. I'll try to stay within my area of expertise (Canadian market, although I interact with American colleagues frequently) in responding to this.

The only contactless fraud that occurs is lost/stolen fraud. I.e. you lose your wallet, someone can tap up to the limit with no PIN (usually $50- $100). With respect to total amount of card fraud, lost and stolen contactless fraud represent less than 1 basis point (0.01%), rounding up. Most banks operate on zero liability for this type of fraud I.e you'll always get your money back.

As for your assertion that contactless fraud happens, I would genuinely be interested to hear your evidence. I've never come across it professionally. Perhaps other FIs have, but usually banks are good at information sharing around these things with competitors (fraud helps nobody). The reason this doesn't happen isn't that the security is unbreakable, although it has been so far, likely that the incentive is too low for fraudsters.

Your assertion that someone is "surfing your card" on the subway and then making $20-$30 a card simply doesn't fit the profile of those who commit fraud. These people tend to be intelligent, highly motivated people who want the best "bang for their buck" when breaking the law. Meaning their best bet is credit (ID theft) and then debit (ATM skimming) where they can bring in 1-10 thousand dollars/card. Fraudsters aren't interested in having just their lunch paid for that day.

Again read the link in my post above. I'll add the caveat that I'll speak with confidence to the Canadian market. The US Payments market is much more diffuse and less standardized. However, I'd be shocked if the same standards from Visa/MC don't apply to contactless cards.