What's actually happening, if I understand it correctly, is that when you setup Apple Pay you essentially get a _second_ card issued to you for that account that otherwise works just like a normal card but is only used by Apple Pay. It's still your card, still stored on the device, and still shared with merchants. If it wasn't you couldn't actually spend money with it.

Hopefully your bank has fraud controls on it to prevent it from being used outside of the way Apple Pay does (which requires your phone or a physical card so prevents theft) but that's not required and without it there is nothing stopping the card from being used like any other.