If they've been "amazingly trustworthy", why aren't you rewarding that with trust? Not telling you how to parent, but that's literally what the word means.
I think you'd have options at the individual app level. Netflix and Plex, for example, allow multiple profiles. You can set a PIN on your profile to keep them out.
BTW YouTube Kids is available for Android TV, which is great!
Look into doing it at the router level. You can assign rules on an individual basis based on mac address. Asus has pretty good parental controls. I have the rtac86u and it's the best router I've ever owned. I use the time scheduling but haven't added any filtering because we login and see what they're viewing on netflix and youtube history etc and can deal with things if they come up.
Also, Vidangel is pretty cool. It is a service that links to your netflix and prime to add filters to content.
I have a smart tv (900f) and a Steam Link
I guess what are you keeping them safe from? Time? content?
How old?