Inviting Apple or Google into my transactions is a security breach to start with.
TLDR: only iPhone users with Visa cards in their Wallets and Transit Mode enabled are at risk. But considering this has been public since 2021, it seems like it should have been fixed by now.