Locked down devices are kind of the only solution that both (A) preserves privacy and (B) solves the problem. However, it indeed strips a user of the freedom to use their device in the way that they want; although, safe to say that the US doesn't have all that much problem with that, given Apple's continued market dominance.
The alternative is what we're getting right now: laws that require verifying ID documents, often in ways that restrict even the notion of maintaining the user's privacy. Attestation might be an "OK" to "good" solution while this is between bad and really bad.
Client-side filtering solves the problem, because children's clients are owned by their parents. We should mandate that websites and apps send metadata about the content being served (eg extending the Rating: RTA header from 20 years ago) and mandate that OSs/browsers allow filtering to be easily configured at setup. This is a more private but also much more granular/useful solution, it's only difficult today because of a lack of coordination
It's not difficult at all. It's not good enough for lawmakers. Their requirement is opt-in to adult content, not opt-out (i.e. the goal is parents don't need to interact with their child or set up parental controls themselves). Which is really bad.
It is difficult for parents to do this today! You can either have a limited set of apps with no general internet access (fine for younger kids), or domain-list filtering which takes significant work to set up, has many false positives and negatives, ie it's both a chore to request/allow useful things, and easy to get around. Lawmakers have been convinced the solution is opt-in, so websites can self-categorize and nothing needs to be configured on device – and I agree that websites need to self-categorize, but then this would make it very easy to reliably filter on device.
my iPhone has "Limit Adult Websites" as an option - and it blocks some known less-than-mainstream adult content sites. I can basically guarantee it consumes the RTA header/label in addition to maybe a list of sites Apple maintains as adult content (maybe similar data to those DNS providers with an IP that DNS blocks adult sites).
The alternative is what we're getting right now: laws that require verifying ID documents, often in ways that restrict even the notion of maintaining the user's privacy. Attestation might be an "OK" to "good" solution while this is between bad and really bad.