give them a desktop that is basically xubuntu amd64 (xfce4 desktop on xorg) + firefox + chrome, and then install all of the best adblock extensions in both browsers. Even the most clueless parents can't successfully download and run windows binary malware/ransomeware/viruses on that.

the xfce4 GUI is close enough to traditional windows98/windows2000/winXP models that most older non technical users have no problem with it.

the best thing for non technical users/older users/ignorant users is to give them the closest approximation to a thin terminal web browser, whether it is a linux desktop or a chromebook type thing.

This would be my suggestion as well

Also might be useful to get a hosts file mapping bad domains to localhost

Or block them at the DNS level for the whole network with something like Pihole[1]

[1] https://github.com/pi-hole/pi-hole