A few tests carried out by CNBC showed that the option is not working as advertised on devices where contacts are not backed in iCloud but other services, like Google's Gmail.
After setting up Communication Limits on an iPhone updated to iOS 13.3, CNBC found that adding to the address book an unknown number that texted the mobile device is still possible, allowing voice, FaceTime, or text message exchange.
The purpose of the option is to allow parents to remove any numbers that could send unsuitable or unwanted messages to their kids. Bullies and strangers are among the threats that Communication Limits was designed to address."A child should not be able to add the contact to the iPhone’s address book without their parent entering their PIN first if the feature is working properly" - Todd Haselton, CNBC
This is not the only issue related to this issue. Asking Siri on an Apple Watch paired to the iPhone to call or text any number is another way to bypass the latest protection for kids. It does not matter if the number is in the contacts list or not.
https://www.bleepingcomputer.com/news/a ... -for-kids/