I’m pretty sure their App Store has a 5-6 year old bug where kids are prompted to use their (child) PIN to authorize purchases instead of a parent’s PIN. I haven’t tested it in a long time though.

I tried to make a video demonstrating it a couple years ago, but VBox video recording mangled it due to a bug. I found it amusing that one bug preventing me from demonstrating another bug.

I tried figuring out how to report something like that to MS and gave up. It’s way too much hassle.