How can an app access Android Pay data on a rooted phone? According to an Android Pay engineer on the XDA forums, Android Pay is not compatible with rooted devices because of security concerns: on unrooted devices apps run in a sandbox and can only obtain limited information.

How is this different on an unrooted device as apps must request permission from SU?

Could an app trick SU into giving it more permissions than possible?

I am interesting in getting Android Pay working on my phone but have concerns about the security of my data as my device is rooted.
By default, only the application itself (and, under some circumstances, the applications written by the same company) can access to its (private) data. So Google Pay can store securely banking-related information.

If you root your phone, however, any application with root access can access to any folder on your file system. Including applications private data. And Google Pay's banking-related information.

I have no idea what Google Pay stores. But there is at least a way to authenticate as yourself. From there, an application with root access could probably do nasty things. Not nasty for Google, but for you: make payments on your behalf.

If you find a way to hide the root from Google Pay (I don't know if it's achievable, but I wouldn't be surprised if it was), and are entirely trusting the applications you give root access to, sure, go ahead. Personally, I would not.