[jmb99]

If the CC is stored in autofill, as is the password, and the child has access to the device (presumably through biometrics), then none of those prove an adult clicked “Buy.”

[whstl]

Still, there is no need to throw the baby with the bathwater.

If you’re claiming that no security is possible, might as well allow anyone to login on any account.

Alternatives DO exist.