Son is bypassing restrictions. Adds websites to “always allow” list

My 11yo son has an older SE with the most recent update. Somehow he is bypassing screen time and has been able to add websites to the web content “always allowed” list (no he does not know the passcode and screen recording is off). He hasn’t changed any other settings. The first time I discovered it, the always allowed list was very long. It is still empty now but I decided to change his settings to specific websites only but he has added some to that list too. I have deleted the sites and they show up again like YouTube and TikTok.

So how is he doing this? Is there an automated shortcut that somehow adds websites to the list and bypasses the restrictions?

Thanks,

Mike