ApplePay requires TouchId. If you could just enter a pin on your phone to use Apple Pay, it would be no more secure than a credit card.
You can use a pass phrase to unlock your phone, but not for Apple Pay. You tap your phone to the terminal, it shows an image of your credit card - without the number - you can then either use Touch ID and use the default card or you can tap on the card you want to use and then use TouchId.
How is NFC always being active a security risk? The credit card information is stored in the secure enclave and is not available to any part of the system until you use your fingerprint. TouchId is tied directly to the secure enclave.