It's the usual security theater. Custom roms do a good job of securing root access for apps, what I find hilarious is a sideloaded app can do a lot more damage yet Android Pay works if you have sideloading enabled... go figure.

You can get Android Pay to work on a rooted device using systemless Xposed framework and root cloak, it basically just lies to the dumb checks.