My son bypassing screen time limits and changing "always allowed" apps

It's come to my attention that my 15 yo son is able to bypass screen time restrictions and add apps to "always allowed" using an old passcode which I have since changed twice. I have his iPhone 6s and mine (iPhone 7) and have been testing different scenarios, but in every case, I can use the old passcode on his iPhone to add apps and turn off restrictions. He is smart enough that he turns restrictions back on so that it looks normal on my iPhone (until I look in "always allowed" folder). Btw, the new/current passcode I set doesn't work on his device; the old code that works on his phone doesn't work on mine. We are both running IOS 14.0.1

Any ideas on how he has managed this, and more importantly, how I can disable?

He has several VPN apps on his phone -- could these somehow enable him to set different codes?