They are unless you add a card, and sign in, and enable the ability to pay without using your password.

most children are using their parents' apple IDs.

So you are admitting that the default users of those phones are adults. In which case, it makes sense that the defaults are set for adults. If an adult is handing their phone (with a credit card enabled on it) to their child, it is expected that they should think of things that can go wrong and disable in-app purchases. If a parent cannot even attempt to keep an eye on what their child is doing on their phone OR click a simple menu setting that disables in-app purchases, I would personally worry about their child way beyond what they can do on their phone.