Shouldn't an in-app browser whose sole purpose is to read an app EULA/TOC/etc. always employ a domain whitelist, regardless of parental controls?

It shouldn't be a parental controls thing for IG, it just needs to be made so when you're using an in-app browser, you're using it for one reason, whatever site you clicked on. Leaving the domain ends the process or opens in another browser.

That could be an "easy" fix where you could disable use of in-app browsers through Screen Time options.

The OS should apply a domain whitelist to apps, in coordination with the app developer and the device "owner". (Like uBlock Matrix)