As to Reg E, the consumer can place a claim to be investigated just by claiming these were unauthorized. I trust the bank did not get approvals on all 75 transactions. Quick research tells me there is adult content in Google Roblox and that makes me suspect as to a claim, compounded by the fact that this happened on the old and a new card within a short term. Obviously the consumer should be quizzed as to who may have access to his devices and if passwords have been saved easing the making of these purchases.
Chargebacks depend on timing, but the bank should also look at the terms of purchase in the Google store. It may be that Google includes Reg E terms in its agreement and under 1005.14 could be responsible for the claim, not the bank. In many cases the Visa and Mastercard rules encourage a bank to assist consumers in chargeback processing even if a claim is denied. https://www.bankersonline.com/regulations/12-1005-014
Lastly, because of the claims, I would seriously reconsider issuing a debit card to this person in an effort to reduce future claims. There is no requirement to issue a debit card to a consumer. If the bank can see the consumer was looking at his/her account online and not immediately disputing the charges before there were 75 of them, it would reinforce my inclination to shut this consumer off.