The behavior is consistent for all Apple Pay transactions, which is what “get” is.The Appstore is run by Apple allegedly for such a reason? Where are users supposed to get an app on iOS other than from the Appstore? If you say "But a malicious software or websites can simulate the Appstore," well then tricking users to click a hardware button should be a child's play.
In other words, it’s the same interaction on an app, on the web, and even in iMessages.
Anything else, as you are suggesting, would be inconsistent.