@MacMartino 

A clever person could find ways to bypass parental controls. These come to mind:

1. Most common is "iPhone private IP address" feature that is enabled by default. It just means iPhone will generate different MAC address when connected to WiFi mesh. If you see in Deco app online clients you don't recognize, it is possible one of them is actually your son's iPhone with newly generated MAC address, different from one it had before. Such device will have unrestricted access until you place it under parental controls. After you do, iPhone user may force iPhone generate new MAC address and will again bypass parental controls.

2. iPhone connects through cellular data, not over WiFi. Considering  how inexpensive data plans are today, your son might have subscribed to one or someone just borrowed him SIM card.

3. iPhone connects by WiFi, but not to your Deco mesh. It could be public/open WiFi reaching your house, or one of your neighbours shared their SSID/password with your son.

4. Your son has a bit of advanced technical knowledge and configured iPhone with static IP address. Device that connects to Deco mesh with its own IP address (not requesting IP from Deco DHCP) will be invisible to Deco app. Combine that with randomly generated MAC address, and here you are: parental controls don't manage iPhone and Deco app does not see it.

-----------------

Generally speaking, using M9 Plus for parental controls is losing proposition. 

If you are serious about parental controls, you will need to replace Deco M9 Plus mesh with different WiFi mesh, the one that supports Whitelist/Allow List. If you still want to stay with Deco, I would recommend Deco X55. See New 1.3.1 Firmware for Deco X50/X55 Adds Support for Whitelist

With whitelist, you can disallow unknown devices that have correct SSID/password from connecting to Deco mesh. That will negate "iPhone private IP address" feature and make parental controls finally enforceable - as long as iPhone is connected to your Deco mesh and not somewhere else.