Kid can reset parent AppleID password using his iPad passcode

I have a family setup with 3 kids and one of them is 6 yo. He is able to reset my AppleID password using his iPad passcode.

I have screen time and parental restrictions but he was still allowed to install apps or make in-app purchases but “Ask for approval” and “Always Require Password” settings are ON. He was able to work around that through Apple security loophole. When he is asked for an AppleID password during purchase - he can just click Forgot Password or input it incorrectly 3 times and iPad will offer password change simply using his iPad passcode. How is it possible that on KIDS iPad, with KIDS account you can reset Family Organizers APPLEID PASSWORD?? just by using this kids passcode? First thing he did when found out about this flaw - he purchased $200 of Robux, which I can’t refund now. Apple is not helping. Small court?