When you add Android GCM to an app, the documentation says “Declare and use a custom permission so only this application can receive GCM messages”.
The Android In-app Billing sample app is not configured with this type of custom permission.
Why not? What is different about Android IAB and GCM that makes the custom permission necessary for the latter but not for the former?
Android in-app billing infrastructure does not make unsolicited calls into your app. GCM, on the other hand, does.