1 - someone got their hands on Apple's private encryption keys
2 - some got their hands on a list of Apple id's or device UDID's
3 - Apple knows this, but wants to fix the problem behind the scenes and keep it under the radar.
My memory of Apple's in App Purchase system is a bit rusty, but my guess is a combination of 1 and 2 is enough to cheat it into buying products on someone else's behalf.
Then again, it could also just be a reused password.
1. Allowing new devices to buy stuff without two-factor auth is weak sauce. 2. The larger meta-point that when we rely on the cloud in a big way, it hurts when we are locked out.
The possibility I hinted at is that someone just "pretends" they have an iPhone and communicate with the Apple server directly. I don't know how their algoritm works, but it may be the case that they only need an Apple id and some secret key that is stored on the device. In that case asking the user for their password is just a way to protect the user when they lose their actual device. That would be pretty insecure from Apple's side. They should at least use the password to generate a key pair. (This doesn't necessarily require anyone to steal secret keys from Apple I just realize)
I completely agree with your second more general point. See also my comment on the Paypal thread: http://news.ycombinator.com/item?id=2880194