I'm not fully versed on how this works, but I believe in most cases with Apple and Android the app itself does not use your credit card or collect the info, but rather you give it permission to bill the credit card you have attached to the store (iTunes or Google Play). Sometimes it's permission for a one time charge, sometimes for a recurring one. So if you gave an app permission to charge, depending on what permissions you gave it, it could easily charge your card for another app, or possibly even pass those permissions on to another app (not sure about that one though).
In general I do not have a credit card attached to either my iTunes store or my Google Play Store and just don't get apps that cost money. If on the rare times I do want a paid app, I will attach a specific low limit card I have for online purchases, make my purchase, then remove the card from the system after the expected charge has gone through. In the past I had left my card attached to the Google Play store, but on at least a couple occasions, had fraudulent charges come through the attached card.