Those aren’t just payment apps, they’re a payment service. Google, Apple and Samsung are “trusted” providers to process payments.

Some FOSS developer could theoretically make an app to process Google Pay but they’d need Google’s authentication, which is never going to happen, for a variety of reasons.

If it was as simple as writing an app it would be done by now. The problem is authorisation, the bank isn’t going to action the transfer request just because Bob’s Banking app says so. The request either needs to come from their own app or from one of their partners (Apple).

Probably the issue lies somewhere else, like legal, infrastructure or sm.

It’s more down to trust and attestation than a technical implementation. Whoever makes an NFC payment system needs to prove to payment processors that the chain of software and hardware from the payment terminal to whatever proves you’re the account holder (a card or a phone) can be identified. And, separately, the implementation needs to be audited.

This may sound like they’re trying to make this horrible walled garden on the surface, but bank users expect their money to not get stolen. And if it is, they expect the bank to make that problem disappear. The bank can only provide these assurances if they control everything.

This is why they use hardware attestation and a chain of trust all the way through to the OS to identify the specific implementation of an NFC payment system. They want to know they can go after whoever created the buggy NFC payment implementation to recover the money or to least stop partnering with them.

Not a lot of FOSS developers would go through the trouble.

My second device is a bank card. Easy.