pull down to refresh

Those cards are not just simple NFC LNURL-w links. It contain a security tag embedded.
Even that the shop could grab the LNURL-w somehow, it still needs the security code to authorize the withdrawal.
Read more here:
https://www.nxp.com/docs/en/application-note/AN12196.pdf

Here more explanations about how to make your own cards with LNbits, BTCpay, BoltcardHub etc
https://plebtag.com/write-tags/