There are 3 passwords on apple devices.
The first is getting onto the home screen, simple 4 digit password.
The second is what you put when you want to restrict inapp purchases, net content and other things.
The third is the Store password. This one also requires the use of the email address and a password that consists of at least 8 characters, not contain any more than 3 consecutive identical characters, include at least one number, a least one upper and at least one lower case character.
Now, from what you are saying op, the lad used the dob password, which implies the second pin... This, until you clarify if the email has been changed on the device, implies that the device was never, ever logged out of the store.
Before you contact apple you need to be very clear because you are wanting a hell of a lot of money refunded. It's nice that others are giving you a bit of hope, but realistically theirs are cases of weeks, not months.
And those saying that ooh an 11 year old doesn't understand the value of money.... Don't you remember being 11? Where you really that clueless about money? No of course not. 11 year olds have pocket money, they know the basics about budgetting, they have to buy their own meals in school. They will have come across money at some point and realise that it doesn't go that far.
The blame isn't with whatever company. The blaim is with the parents. They hand children these devices (laptops, tablets, phones) without knowing a thing about them. They install no controls. They install no security. Nothing. They don't take the time to find out how to make these things safe. All the info is out there. They just need to take time and search.... Yes I have apple devices, that my children and their mates play with. Have done so for the last couple of years. But I took the time to ensure that my money is protected. If that makes me smug, then you know what I would rather be smug than a clueless mug. FFs, as others have pointed out, it's not even like this stuff has never been reported before, but still, the cycle continues.