I did this once with a game called FlyFF. Dad wasn't thrilled. I think I totaled 1500 USD or so. The form itself had validation on the client side to cap out your total money for the daily maximum (100 USD) but the URL parameter wasn't checked value-wise, only your daily total before the purchase was validated server-side. So I knew enough at 10 or 11 to change the URL parameter to get loads more.

Then I got a very, very angry knock on the door at about 7am about a week later when the bank statement came through.

Not sure what lessons I learned there (aside from the obvious) about software design, micro-/in-game economies, or children using your services, to be honest. On the one hand, these sorts of services need to make money. I get that. But it's also super enticing and unreasonably easy for kids to do this, and I'd imagine it happens a lot more than what makes the news.

Not sure what the solution is aside from a very extensive and rich set of parental controls that are mandatory. Not sure if Roblox has that, and if so, I would imagine this kid did what I did when my parents added pins on certain channels - I looked over their shoulder!

Kids seem to be very crafty about bypassing security controls. The OG bad actors, if you will.