Apple has parental controls to prevent this, and basically forces you through configuring them when you set up an iDevice account for a minor.

I have three kids and have never had an in-app or other purchase that I didn’t approve.