If it's just a PIN, and the PIN is his aunts birthday, it might not be much of a challenge. We also have to consider the cases where the adult is complicit, in these cases the app is even less secure than photo ID (for store purchases, not necessarily online).

If adult is "complicit" they can purchase the stuff for the kid anyway.

Why is that even a scenario to discuss?