this is not a fun situation, and the charges are just part of this.
This is a security breach. A breach that was seemingly allowed, too. And if that access was allowed, that then means you own whatever charges were made by the authorized user. Same as loaning out a credit card.
Little people routinely cause issues for their less IT-experienced and more trusting relatives too, whether by deleting files or mail messages or messages conversations or precious photos, or by canceling subscriptions, changing various device settings, swiping various saved passwords, adding backdoors such as adding another trusted telephone number (particularly if they have the Apple ID credentials, see “swiping passwords”), and yes, by spending money on stuff.
The little people are often quite good at all of this.
All sorts of mayhem.
I’ve cleaned up a few of these, and these too often get messy.
Start here, if you want to continue to risk allowing device access:
Or better still, change the device passcode, change the Apple ID password, re-secure the iPhone or iPad or Mac, and don’t allow the little people onto your devices.
Bad stuff can and variously will happen with “loaned” devices, up to and including physical destruction. I’ve met several cases where the little person just stomped / threw / bent the device. Other cases where the little person cleaned out photos and then cleaned out deleted photos album rendering those photos unrecoverable, and too often with no separate backups.