There's also the assistive access or whatever which really locks the phone down but that seems more like for old people.
Alternatively if you wanted to get advanced you could maybe (not sure if it's free) create an Apple business account and try to manage the phone like corporations do. Or you may just be able to generate a configuration profile for free and add to the device. I would expect that process to be a lot more robust generally. You can control pretty much anything. Downside is if you don't have an MDM your stuck with whatever settings are baked into that config profile. Depending what you want to restrict you could pair it with something like NextDNS and lock it down to only safe sites.
Sounds like Android is way better though in this regard. Having to setup a child specific account at the beginning of setup sounds like a pain. If I ever have kids makes me really want to only give them a dumb phone or something like the new (unreleased as of yet) Commodore Callback - has some smartphone features but intentionally no social media