Child can access guest user from quick access setting shutter. They can easily do whatever they want. It's a major bug. Developer only restricted to don't allow to add users from only system settings they forgot in quick access settings.