Those aren't cards. Those are tickets or passes.
Those can be shared. If you went on a trip, and shared the passes with your son, then they would be stored on his device until he deletes them. There's nothing terribly wrong with that.
If you did not share them with him, maybe you forwarded an email or he accessed the British Airways website and added the passes that way?
There's many ways to add passes to Wallet that does not in involve Family Sharing.
_________________________________________________________________________________________________
@Demo, maybe it depends on wether Purchase sharing is turned on. It's not turned on for us, and I can add payment methods from here.