Yeah, I'm a bit surprised it worked too - no apps in main profile, the
one set up in work profile and selected with a workaround I described
- made 3 payments today - feels great)
I thought it would be much more convenient if we could select a
default payment app without all those extra steps.

It also looks like (I'm not a developer, so I may be totally wrong
here =) hehe) it's not so hard to register a payment app in the
system: https://developer.android.com/guide/topics/connectivity/nfc/hce.html#manifest-declaration

And regarding unlocked BL - most apps seem to be fine with the
"Universal SafetyNet Fix" Magisk module with DenyList enforced in
Magisk. At least my microG "Test SafetyNet attestation" passes it well
(d2s - Note 10+, A13, LOS20-based iodeOS, Magisk 26.1)
And of course I'm willing to test if(or when) you have time to implement this)