Well, that's pointless, now that most games in consoles offer in-app purchases, in the form of DLCs, etc.

Not by default, at least in Android.

IIRC, on Android the password isn't required if a payment was done recently (like in 15-20 minutes). That's fairly convenient if you're a sole account user and you went on a shopping spree, but if you share the device/account with someone... The complaint I've read was that if a kid persuades parent to pay for an in-game option then for a brief time they can (intently or not) make further purchases without proper authorization. Or something along those lines.

Not sure whenever this is still the case nowadays or had already been fixed - last time I've made payments on Play Store was months ago.

Ignoring everything in that last statement after the "but", you say:

I know it's devious for app developers to go after kids

Agreed. Google is doing something about that.

The trouble with parental controls used to be that they worked differently then advertised. Parent configured password, but there was grace periods of password-less 15 minutes after each buy which was not explained to user. You had to follow tech news to know about it. Or, parent configured password, but the password was required only for app store, not for IAP.

Apple store does not allow you to download anything, not even free apps, if you do not have credit card set up. So, if you wanted anything on that device, you had to configure it there.

Essentially, parental controls are getting better slowly, but only lately and under pressure of regulators.

The other issues are already existing regulations about marketing targeted at children and when the word "free" is a lie. EU restricts kids targeted advertisements in general and has rules against lies in advertisements. A lot of debate is friction about whether app stores should follow the same rules as everybody else and how to interpret those rules in apps.