You’ve done nothing wrong but FYI you can block things at a device level in most cases. My little kid currently has device level restrictions as well as NextDNS restrictions. As she gets older I’ll probably look at something more strict like a provisioned profile to make it harder for her to work around those restrictions. Nothings perfect and as you said kids will find a way.