And what exactly are they supposed to do? Monitor all private communications?

At that scale you would need an AI. Once the AI sees something possibly bad, either you have a real person check it (people would complain about privacy, the mental health of those employees having to see awful things) or you have the AI ban (people would complain about lost accounts)

No matter what instagram does they lose. So I think doing nothing is the right thing. Maybe the parent should have done some parenting.