One thing to consider is that the phone will not receive security updates ever again, making the child's phone a piece of juicy "low-hanging fruit" for attacks that intend to ransom the data in the phone, hijack accounts, or facilitate identity theft / financial fraud.
I agree that any kind of stock trading or banking app is best kept off-limits for that phone forever.
Personally I would go far as to want to ban apps that that store credit / debit card info in order to work. This might include Uber, Lyft, Venmo, Paypal, Amazon, and any other kind of ecommerce platform logged in with an account. This might also include any other kind of app that has a "premium" feature paid for with a credit card with info accessible via the app (Spotify, Netflix, etc).
I would also be concerned about using any non-burner emails in an email app. If an email app counts as "essential" on the phone, it should be logged in with just a burner email specifically made just for sending files on / off that phone. The user's real, "primary" personal email account should not be logged in on the phone.
Same goes for any kind of "drive" cloud storage app with essential files on it (like say, all of his schoolwork stuff). Wouldn't want that to get hijacked and then ransomed.
Any pictures taken on the phone be treated as "low value". If there ends up being a high value photo/file archive building up in that phone (like sentimental old photos, academic work documentation, etc) they should be backed up elsewhere via a secure method that doesn't involve a login with "primary" credentials (the burner email, a burner Signal / non-Signal E2E messenger account, a USB-C flash drive, etc).
Speaking as someone with an old Pixel 3 still lying around, I still enjoy using it to play MP3's ipod style, navigate with mapping apps (offline or via another phone's mobile hotspot for traffic info), and occasionally search wikipedia. But that's about all that I trust it to do!
Glad you found the solution the original problem, and I appreciate everyone who's indulged my derailing tangent about the risks of Pixel 3s.
-z