My 9 yo has alt accounts I didn't setup, that's how easy Roblox is. I have MC/Microsoft account info for like 10 people, mostly family/friends kids, in my password manager because their parents were fine with them playing, but didn't want to deal with account management. Every sleep over starts with me logging everyone in on the various available devices, with their parents on standby to help with the multi-factor shitstorm that ensues.
Roblox is getting pretty bad though with age verification, and they will NOT help recover a lost/hacked account no matter how much money was spent on it. 5 year account, likely thousands of dollars in robux spent on it, kid clicked a bad link and it's gone. Roblox just responds they can't help, even though the original email address was verified, and used 2 factor auth through its history. They used to be helpful, they don't care anymore.
In a way I found sketchy/scammy aspects of Roblox helpful to educate my kid about that sort of thing. Early on a classmate scammed her out of some item on AdoptMe, nothing monetary valuable but it shook her and really caused her to think critically about online transactions and security. These days the friend group talks about IP bans and account bans so we did a good session about what IP addresses are, how they work, etc. She also did temper her expectations on how attached to get to the main account since it can get hacked or locked etc.