I think because kids accounts literally exist and don't allow this. The did didn't set up a kid's account for his... kid. Google had safe guards and he used exactly none of them. I'd blame Google if the kid subverted the controls in some way, but doesn't sound like he did. Either the dad let the kid use the account, lied on account creation for the kid or turned the controls off because they were too annoying (this one I have seen a lot). At a certain point we have to be responsible for our own actions.

Okay but like... so what? Like does that even really pass the common-sense test that that is enough?

Like my bank would give me a phone call before I wired $20k oversees. Google should by default send you a sms confirmation on your first $10k+ purchase. This is the type of common-sense stuff that isn't an issue in-person, but somehow online we get the most barebones protections for consumers because "technically the EULA said so and so."

Basically if we make the corporations liable for it, we give them an incentive to prevent fraud, identity mistakes, etc. Whereas if they are not, we give them every incentive to avoid unintended purchases.