Issues with parent control

I have family sharing with my 10 year old and monitor her screen time. We have specific “always allowed” apps and others that aren’t included and are set to shut off during scheduled downtime.

All was going ok, until a couple weeks ago when I noticed she was using apps that should be timed out overnight. Upon checking from her device, when looking at screen time in settings, the list of “always allowed” apps is open and no longer password protected. I’ve changed the password and it asks for a password to make changes to the scheduled downtime but the list of apps is always unlocked. What is going on? She now can easily add all apps to be always allowed. Help please!!