The threshold varies between banks but there is often a limit as to how much you can spend or many times you can use "unverified" contactless payments (i.e. not Apple Pay which forces biometric verification) in a row before it will stop and demand a Chip+PIN transaction instead, to prevent someone who finds/steals a card from spending large amounts without ever needing to know the PIN.

For example, if the contactless limit is £100 and it only allows four contactless transactions in a row, the worst damage that can be done is £400, so banks and card issuers only need to manage the liability for fraudulent contactless transactions up to that amount (Visa and Mastercard call it "Zero Liability" protection).