However you're not actually sending Bitcoin on the blockchain. The app is transferring Cashu ecash bearer tokens - cryptographic claims on Bitcoin that's held by a mint. This is what enables the offline NFC tap, but it comes with the classic double-spend risk of any bearer token system: the sender can duplicate the tokens and send them to multiple people before anyone redeems them at the mint.
Remember the Unruggable Cashu Mint: #1503788
https://twiiit.com/DocumentingBTC/status/2075267327377945068