When the iPhone is turned off, most wireless chips, including Bluetooth, Near Field Communication (NFC), and Ultra-wideband (UWB), keep running for up to 24 hours. This way, the phone still remains locatable via the Find My network and you are still able to access items like credit cards, student passes, and digital keys.
The wireless chips run in a Low-Power Mode (LPM), not to be confused with the energy-saving mode that extends battery life. Support for LPM is implemented in the hardware, meaning this problem cannot be fixed with a software-side fix.
The issue seems to stem from the fact that LPM features have been designed around functionality and apparently not much thought was given to possible threats outside of the intended applications.
The findings were disclosed to Apple and the company also read the paper but did not provide any feedback.