Comment by Fethbita

It does not use on-card verification, because if it would have, the problem would not be present. You can check out their FAQ on the 2019 report[1].

[1]: https://security-explorations.com/java-card.html#faq