The big question would be, who has your Passcode to your device? If you did not make the purchase, then anyone you have given your Passcode to use your device is authorized by you to make purchases also. If you did not want them to make purchases, then you would need to be proactive to take the necessary steps to prevent that from happening, such as Screen Time restrictions or requiring a unique password for purchases.
If you share your Apple Account with anyone else, they can do it on their device where you would be responsible for those purchases. It is not possible to sign in your Apple Account on another device without your credentials, including the verification code sent to your device when using Two Factor Authentication. To check if there is another device able to make purchases on your Apple Account, go to Settings > [name on top], and scroll to the bottom.