You do need the password to make in-app purchase since iOS 4.3. Apple did listen to parents complaints. Your comment is true for older versions however.

"We are proud to have industry-leading parental controls with iOS," said Trudy Muller, a spokeswoman for Apple. She said users have always been able to use parental control setting and restrictions of in-app purchases to protect their iTunes accounts from accidental charges. "With iOS 4.3, in addition to a password being required to purchase an app on the App Store, a reentry of your password is now required when making an in-app purchase."
(http://www.macrumors.com/2011/03/10/ios-4-3-requires-password-reentry-for-in-app-purchases/)

... seems to me there's a lot more to worry about than in-app purchases.