I have to enter my password every 15 minutes that I buy something from the App Store. The change felt recent, maybe after high-profile cases of toddlers spending $$$ on in app purchases?

The fact that "I'm going to change my phone number, which is an important credential to this account" has less security than "I want to buy an app for $0.99" just goes to show you that sometimes, particular emergent properties of a system are not what any logical person would come up with deliberately.

That or someone just needs to make a big enough stink and try to get the liability shifted to Apple for negligence here on account takeovers, and they'll figure out how to change.