From what I've noticed on my iPhone, the App Store only asks for your password the first time you download an app after you unlock the phone. I imagine this is to avoid being prompted for it before each download, which would be quite annoying if you're downloading say, 20 apps at a time in a given session.
The password prompt doesn't seem to be to verify the user's intent to download as much as it's there to verify the user's identity. (i.e. What if someone else is using your phone? The assumption is that the person unlocking the phone is the person who will be using it for the rest of the session until it is locked again.) For intent to download, the store instead requires two clicks on the download button to start the process.
In this particular case, the kid probably downloaded another app first, which prompted for his password. Then he somehow tapped the purchase/download button TWICE for the $1000 app.
While Apple's supposed user-experience-centric UI design generally tries to avoid annoyances by making assumptions in what 99% of users intend to do, here it resulted in bad press. For reasonably attentive users buying apps that only cost a dollar or two, this seems like a reasonable and low-risk assumption to make. The App Store just wasn't designed with particularly inattentive users or apps that cost hundreds of dollars.
I agree that the store should prompt for password EVERY time an app above a certain price threshhold is downloaded, and would not be surprised if that change is made for the next version of the iPhone OS.