No, the kid didn't steal anything. Just clicked the button to buy the in-game stuff, and Google deducted it from the credit card tied to my account without requiring any authorization. The fault here was entirely with Google.
If you don't pay attention, when purchasing an app or anything else the first time, you enable by default the "fast workflow" that doesn't require authorization for the following purchase.
It's also hard to find the setting again in the play store app.
All is made to reduce friction when purchasing... Which doesn't align with the goal of most parents.
they will nod their heads and put in some controls, but eventually the dark patterns will come out again.
That was the authorization.
I'm not hostile, I'm just explaining that playing a game is not the same thing as authorizing a financial transaction. I don't understand why you insist that they are.
An online financial transaction should at the very least require a password or pin code. Preferably a redirect to my bank where I authorize the transaction through my bank's authorization mechanism (which uses 2FA). I go out of my way to disable everything that doesn't do that, including pin-less NFC payments on my bank card. At the time, I'd also set Google Play Store to always require a password (which should really be the default), and yet it executed a payment without it.
To suggest that a simple button click in a game played by children should be enough to access my money is ridiculous.