Now let's say, you have your children's devices on their own separate SSID on its own Vlan, with some DNS restrictions, oh wait they can just turn on their personal hotspot on their phone and connect their other devices to it because Screen Time has no way of disabling that feature, and AT&T has no ability to do this on their own (Verizon can do this however).
If they're old enough for a phone, they're old enough to figure out how to get around your blocks. Our 12 year old was informed of a Discord server (at school by other students) specifically for sharing proxy websites that get around website blocking on their devices. And the urls were all inconspicuous, like a website about minecraft skins has a subdomain just for hosting a web proxy.
You can do your best to block, but education around bad actors and what to look out for on the internet is far more valuable here imo.