Why do you think it is horrific? Haven’t had the chance to look into it so all I know about it is that it uses Java ME which is a very limited subset of Java SE.
I would much rather a defined protocol rather than arbitrary code. It also means you can require multiple distinct applets on your phone for each card provider.
I wonder if any environment uses log4j? (jk I hope. The JavaCard spec is fairly limited so maybe it's accidentally safe :D )