We added an iPad and tried to purchase something, but the only card on file was long since expired and thrown away.
But in order to verify the account we had to enter the card's digits, which we did not have, and we couldn't add a new card because we hadn't verified the old one.
In other words we were stuck. Had to contact Apple support. Took several days to resolve.
What possible security or business justification could exist for that? What does it even mean to 'validate' a card you've been billing successfully for years?
(Spoiler: in case this happens to anyone else, the secret turns out to be disabling family sharing on the account. It will then let you remove the old card and add a new one, after which you can re-enable family sharing.)
I don't have a magic solution but all this using random factoids about us as identity verification seems to be a big hassle.