Child account is able to change their own date of birth to over 18

We have had a child account without our family for several years now and we use this to manage my son's screentime on his windows 11 PC. Recently my son told me he was asked to verify his age by the windows xbox app, this process sent him a text message with a link, at first it failed, and the second time it worked. However it verified him as an adult, when he is only 14. This turned off all ability to control his screentime. My son was then able to login to his microsoft account and change his date of birth to be his actual date of birth (under 18) and as a family admin I am then able to add screentime setting, but my son is still able to change his date of birth to make it over 18 again from within his own account. From what I had read this should be impossible to do.

I have contacted microsoft support about this, and shown them the issue while sharing my screen with a support agent. They confirmed the issue and escalated it to their supervisor. I then got a call the next day from the supervisor who told me this is a know issue that microsoft is aware of and working on a fix, and that it is affecting lots of peoples accounts, and that it would be fixed within a week. It has now been over a week and my son's account can still change his date of birth.

As this is a child safety issue I would have thought microsoft would be more proactive about dealing with and fixing this issue. I have searched for other people with this same issue and can't find anyone reporting the same problem. Which if this is genuinely a problem affecting a lot of accounts I would expect people to be complaining about it online. I feel like the support agent was just giving me a standard line so they could close the support ticket, rather than anyone fixing the issue.

When I login to my sons account and visit https://account.microsoft.com/profile I can see his date of birth, I am then able to click the date of birth, which makes a GET request to https://account.microsoft.com/profile/api/v1/personal-info/msa-profile and responds with the JSON string

{
    "ageGroup": "notAdult",
    "structuredBirthdate": {
        "day": "12",
        "month": "5",
        "year": "2012"
    },
    "country": "UK",
    "dateOrder": "DMY"
}

I can then edit the date of birth on the form and submit it, this then sends a POST request to https://account.microsoft.com/profile/api/v1/personal-info/msa-profile and updates the date of birth on the account. This should not happen. The JSON clearly shows the account is notAdult so should not allow the date of birth to be changed.

Steps to reproduce:

Visit: https://account.microsoft.com/profile

Click the date of birth

Select a date of birth that makes the person over 18

Click Save

The date of birth is then saved as the over 18 age and the ageGroup is changed to adult