6yo accidentally spent $40 on in-app purchases, now what?

Left my phone on the couch for 5 minutes and somehow my oldest figured out how to download a free game and buy gems or whatever. Got hit with $39.99 in charges that I didn't approve. Called Apple and they were actually pretty helpful, got a refund but they said this is super common. Now I'm paranoid. Do I need to get a separate device just for him or is there a better way to lock this down? Also I'm an idiot apparently.