Your story contradicts itself when it comes to Apple Pay or at least needs to be clearer .

"On the upside, pre-installed Apple applications are not affected. It is
not possible to replace Safari through such an attack. On the downside,
once on the device, malware installed through a masque attack can
replace anything downloaded through the app store. Like PayPal. Or
Apple Pay."

Apple Pay (Passbook) is a preinstalled app through iOS update 8.1. Now, a fake app could theoretically replicate one of the apps that uses In App Apple Pay but even then based on the EMVCo Tokens that Apple Pay utilizes no PAN data is being sent to these malicious apps and the information that is sent is one time use and can't be used to create fraudulent cards.