Credit cards don't have radios in them with 24/7 internet connections and software vulnerabilities.
I think it is reasonable to assume, as mentioned elsewhere, that rooted devices are more prone to data-compromising attacks. And, due to security bugs, devices that are rooted may not have been rooted with the owners knowledge or permission.
It's a lot harder to attack at scale when targeting credit cards than an attack that targets mobile devices.
The difference is, you don't actually own your CC. You have physical possession yes, you can manage various aspects of it yes, you can even turn it off if you desire - but you don't own it. The bank does. The bank controls the card far more thoroughly than you do, including rights to create, replace, remotely destroy, cancel transactions, etc. You have the physical card and you can use it, but all of the permissions you have are rights granted to you by the true owner of the card - the bank.
My (honest, I'm not trying to pull your leg or anything) question is:
I have a phone. I own it. You (payment provider) cannot control it and I might do stupid things.
I have a credit card. I own it. You (card issuer) cannot control it and I might do stupid things.
Where's the difference? How can CCs work, but Android Pay/Samsung WhateverWhyWouldIUseIt doesn't, given my current impressions above. Can you correct my errors?