IMO that's not the issue
The issue is the lack of safeguards. In our rush to call out the dad based on the headline, we shouldn't let Google and the banks off the hook. The dad should have set limits on the card/account and paid closer attention to the kid's view/ad activities, but both google and the banks benefitted from the poor design/usability issues that led to this.
EDIT: Since it was the company card, maybe the dad couldn't have set limits on there. He used the company card on an older purchase, and since it was tied to his account, google offered the card as a payment option when the kid went to boost his ad. While I'm at it, screw the advertising industry that made YouTube into the mess it is now.
As for this bit
why is a 9 year old even allowed to post to YouTube
I remember about 15 years ago, a lot of kids wanted to post gameplay videos and music/art they made to YouTube. Some parents handled that poorly yes, but others took the time to watch the videos and approve them before anything was uploaded.
Kids want to explore their interests and it can be healthy to explore it with them, and teach them things along the way. Telling them no outright might push them to do it anyway, but this time without supervision.