The apps that enable tap-for-payment ask your bank for permission and some security details to activate using cards for NFC.

In North America, banks won't give that permission/security info to any android app but google pay, and only if the play store verification thing says the OS is fully secure - and google pretends grapheneos doesn't hit those security metrics.

So yes, NFC is how tap-for-payment works, but unless NA banks implement it themselves, or trust a 3rd party that isn't google to implement it, grapheneos phones are blocked from using the tap-for-payment functionality.