This is still an issue in the latest and "greatest" macOS 10.13.1.
My son got our machine infected so after rebuilding the machine I've tried to lock down his profile using Parental Controls.
Parental Controls > Apps > Limit Applications on this Mac > Allowed Apps
Firstly white listing Apps just doesn't work. I raised this as a defect with Apple and the responding by closing mine as a duplicate defect. Whether this means they will fix it at some point I don't know.
RESULT: Turn off Parental Controls for Apps
Parental Controls > Web > Allow access to only these sites
Secondly white listing Websites basically renders the profile unusable. For example, try whitelisting YouTube and then attempting to view a video. As the page tries to load the focus-stealing prompt will appear dozens of times with all manner of IP addresses and web addresses asking for access. I know that websites contain content from multiple sources and so do Apple so why can't they make this process more manageable.
RESULT: Turn off Parental Controls for Web
These issues basically render these important Parental Controls useless and I'm left with a machine that's vulnerable to infection again (yes I realise I could use OpenDNS or my router to filter traffic, but I want to use the built-in features on my OS to manage just one user profile).
This original post was created in 2014. Another reply mentioned seeing the same problems in OSX 10.5. Clearly these issues have been ever present.
When will Apple address this?