This was a big story not that long ago and prompted an FTC investigation. Apple fixed it in their latest iOS update by prompting for the password every time.

Even for an adult, using the phone alone without a child's fingers prodding randomly at the screen, a popup with an instantly charge my credit card button and a cancel button right next to each other is hardly a peaceful and serene thing to deal with when it pops up unexpectedly as you try to hit the tiny button that you hoped would allow you to avoid this very question. That's why it reminds me of those "You are trying to leave this webpage! OK Cancel" things.