As a parent, and as a person working in the wireless industry, I share this frustration. The main issue is that a true client-based parental-control solution will:

a) eat up more data as the client's parental control component needs to continually update its URL database;

b) require more CPU and RAM (i.e. more expensive phone) if you want a better "content inspection" engine (since URLs are notoriously easy to bypass);

c) you are willfully acting as a MITM and creating a backdoor by forcing all content to be decrypted in some way for the solution to work effectively and only controlled by you (the parent), which may (or may not) compromise your stance on the issue of e2e encryption, privacy and security;

d) (your point above and following from c) having to personally safeguard and secure your child's device;

e) on Android, is it even possible to not root the device? Where's there's a will, there's a way: most kids with smartphones coupled with an incentive to bypass controls (Minecraft was a good example given above) could easily root their device, or eventually social engineer their parents into choosing future devices that are rootable.