I mean, ultimately it can always be worked around... even if you were to add stronger forms of identification, a kid can take the parents card / ID / DNA sample / whatever when they are distracted and verify themselves. If a kid is smart enough to set up a VM like that they are smart enough to deceive adults. Teenagers have been finding easy ways to get to forbidden stuff for centuries.
I'd much prefer if the source of trust is in the local device, in the OS, that is responsibility of the family to control, and not on some remote third party service offered by some organization in who knows where with connections with who knows who. If parents don't properly limit the local user account of their kids, or restrict access to the places they don't want, it's their responsibility. Set up proxies, blockers and lock the OS locally, but don't mess up the internet for the rest of us.
Parental controls means the control is done by the parents.. not by the companies. I don't need to tell any company what age bracket my kid might be, all I need is for them to tell me how can I block / restrict access to their services in my parent-controlled network (or how to allow them, if using allowlist).
Standardization of parental controls would be if routers and/or the OS of the devices came with standardized proxy settings that allowed privoxy-style blocking of sites in a customizable way so we can decide which services to allow... with perhaps blocklists / allowlists circulating in a similar way as adblockers do.