That shouldn't be much of an issue. I didn't plan on NFC payments going forward. If I use the web minimally and toggle the internet off when not in use, that should be pretty secure, right?

Yes, Vanadium (or any browser based on the system WebView) is going ot be up to date and as secure as it gets on a mobile OS.

I only mentioned NFC because you mentioned Google Pay.