I just got charged 0.30£ by Niantic, the publisher of Pokemon Go, to verify my age during the user registration process. The payment was initiated from the iOS app and done through a web form. No IAP.
Now I can only hope Niantic doesn’t charge me for something my kids do in the game.
This is exactly the kind of thing I fully expect Apple to protect me from.