So the issue stopping NFC abuse is the policing of questioned payments?

[i.e. someone with a auth key can basically choose to charge people what they want (by using modified aerials), it's up the the people charged to complain sufficiently to get that auth key revoked]

I'd imagine that there might be a low bar of complaints to get a key revoked, but perhaps a higher bar to start legal proceedings?