If someone gains access to your device, but does not have the unlock code, there is no way for them to access the memory on the device that contains the critical encryption and private signature keys.

All of the critical information used for payment generation is stored within internal flash memory of the main processor. This is sometimes referred to as a “secure element” because the CPU and flash data are bundled into a single unit that cannot be compromised.