Those cards are not just simple NFC LNURL-w links. It contain a security tag embedded. Even that the shop could grab the LNURL-w somehow, it still needs the security code to authorize the withdrawal. Read more here: https://www.nxp.com/docs/en/application-note/AN12196.pdf

Here more explanations about how to make your own cards with LNbits, BTCpay, BoltcardHub etc https://plebtag.com/write-tags/