Wow this is an actually interesting question. At first it kinda of seems ridiculous that a provider of age restricted content put the onus of said age verification onto a completed unrelated company. To say the manufacturers of devices capable of going online are the ones responsible for verifying the age of the user seems backwards, and a little unfair to the makers of the devices.
But on the other hand, they make a good point that if one company is collecting info on users to verify if they are legally old enough to view the content, and if they are required to get legal documentation to prove it, That could be a security concern. If the site collects that information from it’s users and their network gets compromised, the hacker obtains the legal documents of all of its users. However if you have your device get a certification of your age and be able to pass that cert to a site, and a hacker compromised your device, they would only get the information of that one user. In this way it would act like getting a drink wristband at a concert or large event. Instead of having to show your ID to a bunch of different people, you show it to one, and everyone else just sees that you’ve been verified of legal age without needing to see the actual ID.
On the other other hand, since personal devices are fully in the hands of the users, it would be pretty safe to assume that users will be able to trick the device into believing they are of legal age with relative ease, so it’s effectiveness might not be that great.
That’d be cute to try and enforce on any self built system, general purpose laptop, Linux distro, used devices, mobile hotspots.
ISPs want to get into that game? No NAT allowable, VPNs, proxies.
Global interconnected networks cannot be dictated by a single jurisdiction. The number of variables involved are simply beyond any given entity to enforce.