Tokens are equivalent to your card, but only at a specific merchant. This can still be a problem for large merchants but is much less of a problem compared to a thief being able to use your account # anywhere.

The most likely cause here is just a guessed password. Tokens are typically stored server-side, it is possible but unlikely that the McD app is doing something like passing that un-encrypted.

With the number of password lists online, it is very easy for thieves to try a leaked password you've used on another site. Especially if the app does not have proper login rate-limiting.