It’s default on kids accounts on iOS. This sounds more like she let her kid use her own iPad on her own account, not her kids account.

Also when you use the App Store the first time on a fresh device it asks if you want to use a password (or Face ID etc) on each purchase, where she chose not to.

I’ve recently set up an iPad for my kid and any purchase needs a password entered into her device then also gets sent for manual approval to our phones, and my wife and I have password/face protection for every purchase on the App Store including free apps.

I despise the predatory methods used by apps to tempt kids into IAPs but also in this case the mum specifically chose to disable passwords on purchased and let her kid use her iPad with her adult account without monitoring her.