... but how the phone actually scan the small thing to open the mycelium directly and ask for a decrypt password?
It would have been using a simple dataset on the tag that was a "bitcoin:" URL... as described here:
https://www.reddit.com/r/Bitcoin/comments/2n0k3i/breaking_bitcoin_nfc_payments_now_secure_bip38/Mycelium registers a listener in Android that advertises that it can handle "bitcoin:" URLs... so when you scan the NFC tag... it finds the "bitcoin:" URL and launches Mycelium automatically (if configured to use Mycelium as the default app for "bitcoin:" URLs, otherwise it'll prompt which app to use like it does on my device).
It's just like scanning a QR Code that has the same URL... like this one:

(NOTE: Password should be "password123", but the functionality in Mycelium is broken as per the OP)
When I scan it using
"Barcode Scanner":

and tap the "Open Browser" link... it prompts to open it with Mycelium (or one of the other apps that is registered to handle "bitcoin:" URLs

):
