Is Safari allowing extensions to be installed by stray clicks in a web page?
It’s far more likely they installed software that says it’s for “playing videos” or “flash player malware / adware” or just installing Java which loads cruft now a days unless you carefully read and correctly opt out.

If you run Malware Bytes anti Mac - what specific malware and adware are your parents getting in to? That would give you specific bad actors and then be able to target specific behaviors or training needed.

You could try installing a locked down browser like Brave, but I’m guessing they’ll want something that has un-desired add on and you’ll either need to outsource the cleaning or remove the admin account. Even iPads get hijacked with bad ads that pop up scam messages. It’s a never ending war of social engineering that you’re fighting here.