Too easy to disable even with deactivation lock

I installed the ControlD easy configuration app on my kids' Android devices and set a deactivation lock PIN on the endpoint. But it turns out all they need to do to get around it is shut off VPN, and the ControlD app doesn't do anything. It doesn't re-enable the VPN, it doesn't ask for the PIN -- it just doesn't do anything if the VPN is shut off.

It would be helpful if the ControlD app could be made a "Device Administrator" on the device so as to be able to enforce better.