But Apple will never do that, since they earn a lot of money on IAP, and the users who are exploited don't complain. I think what is needed is legislation, but

But Apple will never do that, since they earn a lot of money on IAP, and the users who are exploited don't complain. I think what is needed is legislation, but formulating it seems difficult without banning all IAPs entirely.