One problem might be that many kids know their parents' password – they mght even be the ones who created the account for their parents.
I remember the first purchase I made on Amazon. I was like 13 and I needed my mum's card to make it. She knew nothing about computers and almost nothing about the internet. It took her 2 weeks to look into it before giving me the OK. She then struggled through the Amazon website to get what I wanted. Spent a large amount of time making sure she was only getting one, the item was correct and it was being delivered to the right address. She then pressed the purchased button.
That is parenting. That is common sense. I have no idea when it became the norm to trust teen and preteen kids with parents passwords and access to credit card linked accounts.
2. the parental restrictions configuration uses a PIN independent from the SIM PIN and the account password, parents can disable IAP even if their child knows their appstore account password. It will not prevent the child from buying new applications, however (unless parents also disable installing applications, I guess).