Though you've been given various correct answers, you haven't yet marked one as the Answer, so I'll clarify to confirm you understand the situation. Understand that I'm simply a volunteer here and not a Microsoft employee, so this is my own opinion and knowledge based on helping in these forums and not Microsoft official policy or documentation, so treat it as such.
The ability for Microsoft Support agents to directly aid in account recovery has been removed as this excerpt from the gray box labeled; 'Important' at the following link mentions.
"To protect your account and its contents, our support agents are not allowed to send password reset links, or access and change account details."
Help with the Microsoft account recovery form - Microsoft Support
This is why the accounts, once verification methods are radically changed aren't able to be recovered, so the best possible solution is that Microsoft disables or blocks the account totally in order to avoid further abuse of its existing products, payment methods, or data.
The reality that most consumers aren't aware of today is that the various wars being waged internationally are often being funded by the theft of resources via criminal or even nation state sponsored operations, leading to what seem like relatively minor things like gaming or personal account thefts being monetized to fund these.
Unfortunately, this has put the average consumer, which includes both children and other often less knowledgeable individuals on the front lines of global cyber-war activity.
This means that previously minor issues like the loss of a personal account have become something that's generally not possible to resolve in a simple or effective manner, so the only viable method is to properly protect the accounts in the first place.
This also means that the always risky ideas like gaming mods or cheats and the sites related to them are virtual landmines that often result in the loss of accounts as a side effect. along with various methods of delivering the popular infostealer apps that though not truly malware, operate by maliciously capturing authentication and other personal information from the systems they manage to infiltrate.
The problem is obvious, since especially children, but even the slightly older, but still inexperienced players have often used some of these in the past or know others who have, so they still assume these are reasonable activities.
They aren't.
The decision you must make as a parent is what's most important to you, since putting your child in this environment is now potentially fraught with dangers for which neither Microsoft, nor any other commercial entity truly has a fully secure solution, and likely never will, though improvements in the security of their systems like passkeys, Windows Hello Face, Fingerprint or PIN and others may obviously help to some extent.
This still doesn't resolve the potential issues for abuse of apps once the device is operating though, so you'll need to make that sort of determination yourself as to whether you feel your child can understand the risks and act appropriately, which may include avoiding certain types of apps, gaming etc., at least until they're old enough to properly handle the risks.
This same sort of issue is hitting the entire gaming industry at some level, though PC, Xbox and similar gaming and system level accounts are some of the most valuable for the spamming, resale and other abusive purposes to which they've been put, since those had typically been some of the most secure in the past.
Rob