I'd say the solution here is to make child's device always connects back to the home network, and make sure the child's account on the device can't change network settings. We're almost there in terms of ease of use: tailscale and netbird are like 75% of the way to usable for anyone... But the last 25% is probably the hardest.