Who will teach them how to (not) use them once they have one? I mean things like privacy, phishing, social media risks, addiction, subscription fees, etc.?

I think the possession of a device isn't the risk itself.

The parent has failed if the child can't teach themselves by that age. Besides, as you say, it's not so much the phone itself -- those risks can be learned or taught separately from the phone. (I didn't have my first phone until I was 23, but I'm not a tech-clueless zoomer and grew up with message boards.)