It's also a "griefer's first social engineering" hack, so it has at least some small "fun" difficulty connected to it. To add a child account when you aren't directly creating the child account on the same device, Microsoft requires an Invite flow that sends an email to the child account asking them to accept "joining the family". So either the griefer also had the password to the account to login to the account on their machine (or otherwise access emails to it) or they somehow social engineered the victim to accepting an invitation to "join them" for something. The griefer can blame the victim for being gullible and claim that it wasn't the griefer's fault the victim fell for it.