Filters reduce exposure but never eliminate it. A calm, practical response plan for the moment something gets through.
React to the child first, the device second
The first response should be reassurance, not investigation. Children who expect a punishment for reporting something will stop reporting things.
Then adjust the settings
Once the moment has passed, review the web categories and app allow list together. Involving your child in the fix keeps the trust intact.