This is really terrible, I feel deeply for the father's predicament.

This ought to be a salient lesson: never store card details online despite the convenience. Further, as I do, use only a debit card for online purchases with the available credit only marginally more that for one's immediate purchase. It's also an excellent policy in case of being hacked.

Companies that allow employees to use cards with essentially unfettered credit have to take a large amount of the blame in circumstances such as this. There's no reason other than bad policy or irregular monitoring of expenses to allow expenses of this magnitude to build up. The company's financial policies need drastic overhaul.

The father also has to take at least some responsibility for adding the card to a device that the kid is using unsupervised. He also did set up the initial ad campaign instead of doing something more reasonable when the kid was unhappy about not having many viewers on his channel. He gave the kid the opportunity, showed the kid how to do it and then the kid did it some more.