Here's how it works: Let's say an unknown person sends a text to your child's phone. If their contacts are stored locally but not in the Cloud, the Messages app offers to add that person to the contacts. If your kid does that, the number is added and they can call, FaceTime or text the individual.
The way it's supposed to work is when a child tries to add a contact, a parent is supposed to enter a passcode to allow it. On top of that, CNBC found that a child can ask Siri to call or text any number on an iPhone or Watch, bypassing the Screen Time limitations.
This issue only occurs on devices set up with a non-standard configuration, and a workaround is available. We're working on a complete fix and will release it in an upcoming software update.
Apple has acknowledged the issue (above), but said it only happens if the phone is in a "non-standard configuration." Nevertheless, it's working on a fix to stop it from happening. In the meantime, you can make it work properly by forcing contacts to sync with iCloud by opening the settings, scrolling down to "Contacts," choosing "Default Account" and changing it to iCloud. You can also place the phone in "Downtime" mode, which will also stop your kid from adding any contacts.