While I agree regulation must be enforced, let's not forget that if a kid is playing on a phone that has a credit card saved, is enterely their parents' fault.
And same if the kid has access to the card itself.
Laws to regulate lootboxes are a must, and I believe this kind of products should be treated as gambling. But FFS, it's your kid, take some responsibility on what they play and what they buy. A 10 years-old can't open a bank account or a credit card by themselves, so the card is their parents'. You are doing something very wrong as a parent if your kid can dispose of your credit cards unchecked and freely.
Kids have plenty of ways to get access to lootboxes that aren't gated by a credit card, not to mention these games tend to blur the line for paid lootboxes by giving "free" in game premium currencies. Most of these games are fully aware it's a kid playing, they just turn a blind eye because it profits them.
This whole personal responsibility is the same shit that the plastic industry has managed to pull, they are the ones doing it and they are the ones profiting from it, the responsibility is on them to make sure kids aren't playing their games.
Fuck that, kids are kids. The companies are responsible for being able to easily roll back invalid loot box purchases if we allow them to exist in the first place.