As you've noticed, any app added/deleted from one device gets added/deleted from every device linked to the same Roku account. It's been asked for in the past, but it's not likely to ever change. The only real solution is to create an account for your children's devices and add a PIN to the account so apps can't be added without it. That has implications for any purchases/subscriptions you have through Roku, but most here would recommend bypassing third parties like Roku when subscribing to a service.
If you go the separate kids' account route..
The PIN requirement for adding channels only applies to attempts to add the channel from the Roku's on-screen user interface.
When logged into their Roku account, channels can be added directly to the account via the online version of the channel store, with no PIN requirement. So be sure NOT to give them the password to the account you set up for them.
