you might be interested in this news “Pre-game vulnerability allows cloning of chip and PIN payment cards”.
https://thehackernews.com/2014/05/pr...-chip-and.html

You are correct.

Correct.

You can scan any card, copy the track 2, generate up to the next 3 ARQC codes at a time, write it to a J2a040 EMV chip and then scan it with CardPeek and an OmniKey to verify it all got encoded properly, without leaving your desk. It's very much possible.