Anything up to a certain amount. All the banks here have configurable limits for contactless payments (both in number of payments per day and in total amount). If you go over the limit they ask you to confirm in a way that requires the phone anyway. You can also block the cards remotely.
I'd say it's a decent mix of convenience and security, even if you use cards.
And sometimes you have to resort to using cards because some banks have been migrating from using the NFC directly to using Google Pay and I for one don't relish giving Google insight into my shopping.