That is why in most countries (I can't speak for the US) they cap the maximum withdraw limit to something like $100. That way the risk to the bank and consumer is minimal.

Here in Australia our largest bank (Commonwealth Bank) has an app that will generate a code that you can enter into the ATM to make a withdrawal i.e. card not required. It has a similar risk profile to NFC.

Pity the code is so long it's easier just to use your card.

Yes it is. It's possible to charge contactless payment cards even when they're in someone's wallet. That said, it is certainly possible for the implementation to be more secure on smartphones. I knew as soon as I saw the fingerprint scanner and iBeacon tech in the current iPhones that this is what Apple would be aiming for.