I've been in IT Admin for years, and one of my kids managed to subscribe to two things in one day, one that cost $10 per month and one that was $78 per year, despite having exactly these kinds of controls already set on the device.

Thankfully I receive a notification email for activity on the account, so I was able to go through the non-obvious method of unsubscribing before the "three-day free trial" expired when the charges would have started.

The device was setup to require a password for in-app purchases. They even need a password to install new, free apps. I've since locked down the devices even harder, having looked up various guides on all the various settings that need to be changed from their very open defaults.

I've also removed credit card details from the shared family account - which can't be done from the device itself, only via the online account management tool.

I still don't know how those subscriptions got through, but they did.

Thanks for the reminder though, I'm going to check through those settings again, just to make sure they're still tight, and haven't been re-opened by a software update or other "insecure by default" situation.

I can't imagine how far outside 'normal' this level of IT device maintenance is for regular folk.