Guys,
I don't want to spoil your fun debating this story, but just to point out that there's no need to fall over eachother in order to point out an alledged SECURITY problem, because quite frankly there isn't.
Sure, the little boy flew without a ticket and that's in fact both a COMMERCIAL and PROCEDURAL failure, but that's something completely different from a SECURITY failure, which is the word almost everybody has been using here.
Remember the little boy still passed through the security screenposts just like all other passengers, didn't he, so SECURITY itself was never at risk. If JAF subsequently let screened passengers fly without holding a boarding pass and thus paying for a ticket, than that's really just a commercial/procedural problem of theirs, nothing more.
To summarize how things are done at BRU:
1- access to the Schengen terminal in BRU requires only a valid boarding pass. It needn't even be on your name, nor does it have to be to the date, which explains the automated access system in use now.

2- security screenposts then check ALL persons, regardless the reason of their visit. They don't check your ID nor your boarding pass.
3- at the gate, the airline better checks if the persons boarding their flight have actually paid for it from a revenues point of view, but that's just up to them really, as potential security issues have been taken care off.