Here's how it works: Suppose an unknown person sends text to your child's phone. If their contacts are stored locally but not in the cloud, the messaging app offers to add this person to the contacts. When your child does, the number is added and they can call the person, FaceTime or send an SMS.
When a child tries to add a contact, a parent is asked to enter a passcode to allow them. In addition, CNBC found that a child can ask Siri to call any number on an iPhone or watch, or to send an SMS, bypassing the screen time restrictions. A workaround is available. We are working on a complete bug fix and will publish it in an upcoming software update.
Apple has confirmed the problem (see above), but it will only report if the phone is in a "non-standard configuration". Nevertheless, a solution is being worked on to prevent this. In the meantime, you can force contacts to sync with iCloud by opening Settings, scrolling to Contacts, selecting Default Account, and changing to iCloud. You can also put the phone in "downtime" mode, which prevents your child from adding contacts.