That the CC can be used without any form of validation seems to be a problem here.

If Google would just verify the security code or something, couldve easily claimed the user made a willing purchase in such case.

But removing such barriers is more profitable.