I am very confused by this John Lewis email and I say this as someone who shops there semi-regularly.
It is not up to the merchant, only that their terminals should support the Consumer Device Cardholder Verification Method (CDCVM), which was mandated by Mastercard rules from the 1st of January this year (with a few notable exceptions from other large UK merchants but John Lewis does support this well) to fully support Apple Pay, Google Pay, and other mobile wallets.
On the web side, they should support 3D Secure v2.
If you’re using contactless on a physical card (which has no verification), you will be required to insert your card and enter your PIN periodically. Apple Pay, Google Pay, and other mobile wallets should not require this if everybody has played their part in the chain correctly.