Just one simple remark: An embedded SE can be controlled, directly or indirectly, by Google or another wallet provider. By itself, this simplifies the security situation, because there are less actors to deal with.

There is one point for which the UICC is better, though: Total failure. It is possible (and expensive) to replace a UICC altogether if a flaw is found in the depth of the UICC. For an embedded SE, the only solution is to disable it or to replace the device, which is even more expensive.

About the PIN attack, I will comment on a separate thread, because some remarks in some articles are very surprising.

There is no UICC in the plan, because this would mean that Google would have to negotiate individually with each MNO to deploy its wallet. Of course, in application to the “no free lunch” rule, there is a problem associated to that: In countries where MNOs have a lot of power (in particular where they subsidize the phone), Google will not be able to deploy their wallet. For instance, this seems to be the situation in France (although this initial situation may of course evolve, for instance if/when one of the MNOs accepts to launch the wallet…).