Speaking as a parent, the problem with client based controls is access to the client without an argument.
a) eat up more data as the client's parental control component needs to continually update its URL database;
b) require more CPU and RAM (i.e. more expensive phone) if you want a better "content inspection" engine (since URLs are notoriously easy to bypass);
c) you are willfully acting as a MITM and creating a backdoor by forcing all content to be decrypted in some way for the solution to work effectively and only controlled by you (the parent), which may (or may not) compromise your stance on the issue of e2e encryption, privacy and security;
d) (your point above and following from c) having to personally safeguard and secure your child's device;
e) on Android, is it even possible to not root the device? Where's there's a will, there's a way: most kids with smartphones coupled with an incentive to bypass controls (Minecraft was a good example given above) could easily root their device, or eventually social engineer their parents into choosing future devices that are rootable.
My parents stopped filtering my internet at about 8 - I'd been online since 4- and while I'm certainly more scarred and savvy about a variety of strange subcultures than I would otherwise be, I am glad of it. Even before then, the filters had not been 100%; I know by anecdote that I had seen some seriously deranged pornography before the filters completely dropped, and I really just wasn't interested.