Does the law really require third party? Because having on-device functions configurable by parents doesn’t seem terrible at all.
It absolutely doesn't. However, the argument doesn't work when it's about connecting the "is the user a kid" bit to the existing and constantly running object recognition (phone cameras already run skin detection all the time to set white balance), so people invent "third parties" and "report people to authorities".
That's not what the UK is demanding. They want client side scanning malware that breaks DRM, circumvents encryption and VPNs, and bypasses other security features in order to scan everything visible on your screen.