[PreInternet01]

> is that enforced by some certification process

Yes, pretty much any NFC payment solution has to be EMVCo (Eurocard/Mastercard/Visa) licensed, and relay resistance is an explicit part of that.

> seems to be happening in the wild

Nah, NFC is so ubiquitous that would have been a lot more noisy.