The IAPs are vetted by Apple, and a developer who gets authorized to use one can't turn around and reuse that IAP access to charge other things. Yes, some IAP

The IAPs are vetted by Apple, and a developer who gets authorized to use one can't turn around and reuse that IAP access to charge other things. Yes, some IAP scams get by review and end up making the news. But the difference between that happening and a free-for-all of credit card numbers for scam games is massive.