i admit that i've never used a device that NFC is on so please correct me if i'm wrong
i assume that its a service like bluetooth or wifi that is either on or off Correct.
i assume therefore that to be useful it's on all the time Mine is, though I haven't got any payment apps on mine
and therefore i assume you don't have to pre approve merchants or sign up to use it You have to set it up, but otherwise no.
i assume its linked to a credit card or bank account You top it up using your credit card
i assume (from the adverts i've seen) that there is no confirmation step Of course not, it's meant to be quick, but I think you have to go on the app first, and you can have a PIN number if you want.
if all those assumptions are correct my security concern would be that someone could squeeze past me on the tube with a dodgy reader and "take payment". Brilliant point. This has already been recognised as a potential threat to contactless credit cards and you can now even get a lead shield for it. Like I said before, if anything like that does happen (though very unlikely), you are never liable.
the point about fraud protection is a fair one, but that's what you do when you've already had a brickfest, and if you do lose your phone when you are out doing the shopping how long till you get in front of a computer to send the lock code, you can't call it in as someone just stole your phone, obviously there might be a kind stranger who'll lend you there phone to help, but this cannot be assumed