most of your comment is irrelevant because you assume Apple would be calling a external API, while parent means is external calling Apple API to register subscriptions. Then if you have concerns like yours you can stay within Apple ecosystem.
If Apple does not control the actual subscription, but is only providing an interface for managing it, then Apple must then alert the actual owner of the subscription upon changes. There's then no guarantee that the code on the other side is properly handling that alert.