You write you "heard horror stories on the news about kids spending money" and that's what made you took action. But that's exactly the problem: many of those horror stories are from people who never did hear those stories, never knew about the concept of consumable IAP and just assumed that a silly free game was a silly free game. They didn't give their children their creditcard info either, not even their password. They just downloaded a game for their kids themselves, and then Apple didn't ask for a password again when the kid (possibly a 4 year old) just tapped on every nice looking icon it saw and bought a $100 consumable IAP pack.
To much inappropriate content is aimed at kids, not just iap, not even just games, we can't just assume that because its focused in a kids product that the product is suitable for kids. We should be able to hand our children things and assume they will be safe but we can't, especially when handing over an internet connected device.