In my opinion, Apple isn't responsible to reimburse the parents.
If you link your credit card to your iTunes account you're inviting its use. You wouldn't give your credit card to your child and send him/her into a mall. This is no different.
Yeah, it seems a stretch, I guess Apple just settled to avoid dragging it on.
But on the other side, I don't think any cashier in a mall would accept a credit card if a 5-year old happened to brandish one unsupervised. I guess Apple found itself to be that cashier in the virtual world. The password requirement solved that by requiring some kind of authentication.