How can I prevent kids from bypassing parental controls by changing their iPhone's MAC address?

The iPhone is designed to change the MAC address on its own for extra security to prevent tracking. It is not manually being changed by any user. You can review this article to change the setting of the Private Wifi Address, so it does not rotate the MAC address when making a connection.

Use private Wi-Fi addresses on Apple devices - Apple Support

The solution would be to turn off Private WiFi, so the iPhone does not change the MAC address, then set your router to only connect to that MAC address. If your kids have the option for cellular data, they don't need to use WiFi at all, so the settings on the router would have no effect.

The Screen Time features could help you circumvent this issue. You could also block certain MAC addresses on your wifi and only allow those devices with a certain MAC address to connect, if you router has this functionality.

Here some information on how to set up Screen Time on your device:

Get started with Screen Time on iPhone - Apple Support

This kind of problem is best handled in meat space. In six weeks when you return the iPhone to the child, explain what will happen if they try to circumvent your parental controls again.

Failing that, set up a separate wireless network specifically for the devices that need to be controlled. Most routers nowadays support multiple wireless networks. Configure that wireless network with a whitelist of allowed MAC addresses that match the native MAC addresses of the devices to use it. Make sure it has a unique passphrase. Configure the iPhones to connect to that wireless network, with the Private Wi-Fi Address option disabled.

This still would not prevent them from using cellular data. Contact your carrier to see if they have parental control options.