How would Apple know about a new iOS device or Mac signing into your iTunes Store account? It learns of the device the first time you successfully login on the device. Besides doing some sort of pre-registration or requiring an iTunes Store ID to simply buy the device there's no easy way around that. They'd also have to end all used/third party sales of Apple products or require resellers to activate every iPad, iPod Touch, iPhone and Mac they're sold. It's completely unrealistic to do a default deny on new devices.
They could do something similar to what Facebook does: as soon as they detect a new device using your account, send an email.
If the new device is not in the same country as your other devices, don't allow purchases until you've clicked on that link in your email.
And don't forget to ensure that you can't change your email unless you're doing it from an authorized device. Otherwise a malicious person could just change the email address where the notification emails are going to.
