For in person transactions, NFC is perfect. For internet payments, a dynamically generated QR code is secure and far superior to the current setup:

  * find physical card or virtual in an app

  * copy paste or insert "secret" numbers, and trust the website won't save them, because they are static

  * insert a bunch of personal data which the merchant has no real reason to know, but that is used for "fraud detection" because they don't trust you are the real owner of the "secret" static password

  * go back to your phone and get the SMS/3dsecure validation prompt, because it turns out your bank also doesn't trust the secrecy of the "secret" numbers they issued you

  * finally, pray to the cave gods the transaction has gone trough the complex duct tape and  bubble gum contraption, is not flagged for review or reversed by the various intermediaries etc.

It's all a baroque mess, multiple layers of cruft accumulated over the decades. To compare, even a crypto transaction is much smoother and simpler, navigate to checkout, scan the QR code with your wallet app, press pay and you are done. And that's not to praise crypto, any solution designed from scratch for the age of the internet will be much better.

These systems work with several modes, UEN (Unique entity number, Phone number, National Id Number and QR)

I'm not entirely sure how you imagine Visa's fees protect you from Linux kernel zero days. More than likely, the unwieldy infrastructure with massive technical debt accrued over decades has a much larger attack surface and uses a myriad of more or less obsolete technology.

Also, the payment system should not be confused with the banking system. Complete control over the payment system would give the attacker the ability to deny payments or make fraudulent ones, but would not, for example, allow the attacker access to accounts not linked to a payment instrument, or allow them to circumvent the limits set on such instruments.