Their security page makes it seem like your information is fairly untouched. But yea would not trust anybody with that either if I don’t have access to the source code. (or other independent people that are smarter).

I did actually went back to using my CC directly and not over Apple Pay to be less reliant mostly. But iirc one thing apps also do is providing an virtual card to the merchant obfuscating your real one. Not sure how much that’s worth in practice but it is kinda cool.