Financial transactions are held to a higher standard (i.e. there's a bunch of laws around them) than device access. That said, you can make your device passcode as complex as your Apple ID password if it's a tradeoff you're willing to make.

Device asks me to type my kid’s password in. Kid is in my family group. After authorizing my kid, I have to still approve on my device. If I forget kid’s password, I can reset on my device.

Zero extra security forcing me to type in his iCloud password on his device, especially given I have typed it in the passed.

It’s not financial requirements but instead layziness.