Family sharing and payment hickup

Can someone explain this: in a shared family setup, my son wants to purchase a song. I receive the notification and allow the purchase. Besides me having to enter my password despite faceID and my son having to enter his password three times during the purchase (despite touchID), why does Apple then asks HIM to confirm the security code of MY credit card?