I've used a few different NFC pay services (Google Pay, Amex, MC, and my bank's Android app) and in some cases they will work from any screen as long as Android is unlocked, while in other cases they will only work if unlocked and the app itself is running in the foreground. Either way, Android needs to be unlocked for every pay service I've ever tried.
I think this is normal behaviour for NFC payment services. I'm pretty sure this is to prevent payment from a stolen phone.
Would be great if we could get it so that we could use NFC pay by unlocking from CoDi, but AFAIK unlocking CoDi doesn't really unlock Android.