I looked through the security guidelines and it's pretty clear that there's going to be a few implementations that aren't sufficiently secure. It appears that most or all of the work required to secure your content is up to the developer.

Does anyone know how this compares to the iOS implementation of in-app purchases? I would suspect (without any evidence) that Apples provides security mechanisms for this as part of the API.

Well, on iOS since the only real way to execute code is from their app store, its much harder to attack the client code. Android can not do so, so there needs to be defense in depth to protect against that.

What about code you built yourself, jailbroken iPhones?

Now if Google only added more localized payment options. Did you ever try to convince Germans that a credit card is worth the €30 (per year) that banks typically charge?

Even just adding PayPal would improve the situation tremendously.

Wonder if them rolling this out/testing was part of the reason why I had a bunch of billing issues yesterday. Tried to buy two apps, got double billed on both. Immediately afterwards Google cancelled/refunded both immediately. I somehow still managed to get access to those apps even though I didn't really pay for them.

Hopefully, this will lead apps that have a gratis/lite/ad-financed version and a donation/premium/ad-free version to have unified versions where one can upgrade to the latter option inside the app.

Something like this is going to have an intense affect on app rankings in the Market as free apps won't lose their install rates as people decide to upgrade to the paid versions.

I hope not. I actually buy the ad-free version in many cases because I don't want to grant the permissions that the ad-financed version requests (frequently phone state & identity, GPS location, and internet access). If there's just one version, there will be no way for me to use the app without giving the application those permissions.