They are only allowed to use Messenger Kids, which doesn't require them to create Facebook profiles (I have to have one, though). They can't delete their messages once sent, and we can also view their conversations on another parent's phone while they are chatting.

They can technically install another app and add random people as contacts, but it would be very hard to do that without our knowledge.