You know credit card security lays with the banks not card holders, right? Fraudulent charges will be reversed.Giving my credit card to Netflix, Spotify, Hulu? I'm OK with that. To some no-name developer for a loot box? Way too risky.
If every app does do that, 3-6 months later, stories in the press about "iPhone user got charged tens of thousands of dollars after buying a $5 in game purchase, Apple must fix this!"