Being able to understand the value of money at 9 is a bit of a red herring with things like this, dd played on my phone long before she could read or count and understand money, and whenever she tapped the wrong part and the white password prompt came up she was shown how to cross it off and it became second nature, as she got older then it was explained why that box gets crossed off, and that it costs money etc.
Even games intended for toddlers have IAPs, if they are gonna be given a phone to play on they can be learnt that they should cross off that purchase pop up off straight away and expand in why, and other rules etc as they get older.
By 9 most children can read and understand what money is, so even without understanding just how much money £90 is, they'd be fully aware that they spending actual money that's coming from parents bank..
RE guessing password, one of the most common passwords parents have is thier child's name and year of birth, very easy to guess. Was talking about passwords a few months ago with family and it turned out only two of them didn't use their child's name and have changed it since.
Accidents happen but from what you say she knew exactly what she was doing, the value of £96 and that it was something she knew she shouldn't be doing. I'm prob in the minority but I'd not have contacted Apple if i could afford to cover it and have the child pay it back either by no pocket money or handing xmas gift money. As you've been already contacted and been given money back I'd not tell her about the refund and still make her the majority of it back. You say she understands so I'd want her to learn she pays for what she spends.
Dh needs to change his password. I'd not be giving her device back for a long time, and if/when she gets it back id be setting up her own Apple ID, which she doesn't have password for and which isn't linked to bank and if she wants to spend money she asks an adult to purchase a voucher with her own pocket money. If you must use dhs AppleId she absolutely isn't allowed any apps that contain IAP purchases, she asks permission before any download, even free games, dh checks his IDs download history everyday and changes his password regularly. Use an app that generates complex ones that she won't be able to guess.
My dd is 12 now and fully understand if she disobeys any of the rules we have she loses all online access, the lot, no more podcasts, no more Netflix, no more FaceTime, no minecarft with mates, everything.
You said you're mad at your dh as he buys things and she's got it from him. Would you be mad at him if dd had done the same thing with other things he buys? If he'd bought a few things off amazon and dd had sneaked into that and bought stuff would you be mad at dh for using amazon?