How was my son able to make an unapproved purchase?

I am not sharing payment info thru Family Sharing and my son does not have a payment linked to his Apple ID. So how was he able to make a subscription purchase on Discord thru his Apple ID? I'm not looking for a refund, I just want to prevent it from happening again. I did turn on "ask to buy" tonight but how was he able to do this earlier??