There are copious and extensive managed access control technologies available for Chromebooks (and windows, and everything else). I mean, it's true that by default it's just a laptop-running-chrome and can get to anything. But that's not how my kids' schools deploy their Chromebooks, nor is it how we have their personal devices set up. Have you looked at Family Link, which is the default choice for this sort of thing? We've used Bark too. Both are sort of annoying to administer but do their advertised jobs pretty well.

I mean, yes, the internet is distracting, but...