I thought the photos app was a fairly innocuous form of screen time, not realizing that it was so easy to make a purchase! No password confirmation or anything.
Fortunately support made a one-time exception and refunded the payment even though it was well past the cancellation window.
I still removed all the payment methods and addresses from our Google Pay account because I couldn't figure out any other way to guarantee that this doesn't happen again.
Frictionless payment flows do not mix well with toddlers.