Apple Pay actually compromised?

Has someone else encountered this:

• At 10pm in the evening while watching a movie (and not using my phone, or any other Apple device) I am getting notification from the Wallet for a charge using Apple Card - Apple Pay (the actual Apple Pay device card number, not the titanium card number or the virtual card number). Charge is from a utility billing company from another city, same state.
• This triggered me because I hadn't read the details before, but I always had the impression Apple Pay was with an extra layer of security.
• I called it in immediately - first Goldman Sachs - processed the dispute and transferred me to Apple Support to change my device Apple Pay number. Apple support didn't know how to do it, suggested I close my credit card and reopen it (laugh), so escalated to Senior advisor - she plainly explained that Apple Pay device numbers can in fact be compromised by skimming devices (again laugh) and to call back Goldman Sachs again in the morning to change the "Credit card number".
• Now after I did some reading - I found out that Apple Pay uses DPANs in the Secure Element and dynamic one time (per transaction) security code that is issued by the Secure Element (my guess HMAC or another signature). So in theory it should be impossible without going through the proper biometric authentication.
• Yet my phone was laying by my side, no weird messages, no weird websites, no nothing, simply a notification popping up.
• And the DPAN number showing on the transaction is my phone's DPAN number.
• Not that it matters because of the DPAN number showing the transaction authorized by my phone: All my Apple Devices are with me, it was logged only on my current devices, didn't share anything with anybody, did the safety check to make sure of that, etc, etc.